Analysis
-
max time kernel
151s -
max time network
53s -
platform
windows7_x64 -
resource
win7 -
submitted
11-09-2020 08:09
Static task
static1
Behavioral task
behavioral1
Sample
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe
Resource
win7
Behavioral task
behavioral2
Sample
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe
Resource
win10v200722
General
-
Target
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe
-
Size
92KB
-
MD5
7e6416edcfa9e24fd98364d06f26186e
-
SHA1
932db076cf4c1756a430447431ddafa287669c89
-
SHA256
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d
-
SHA512
9f800c63767c381b04dae875384eb1b27b3b5b55de737d15fd61df3b33afa97500c6e26dfbdcd9ad90096e925f6f4ede6f5d831950d197ef0049357b01fc4563
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
smith11@keemail.me
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
smith11@keemail.me
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe = "C:\\Windows\\System32\\4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe" 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe -
Drops desktop.ini file(s) 77 IoCs
Processes:
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exedescription ioc process File opened for modification C:\Users\Admin\Videos\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVV7BJHB\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Music\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files (x86)\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OLSU73OI\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Links\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Documents\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Videos\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe -
Drops file in System32 directory 2 IoCs
Processes:
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exedescription ioc process File created C:\Windows\System32\4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Windows\System32\Info.hta 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Drops file in Program Files directory 27843 IoCs
Processes:
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exedescription ioc process File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Atikokan 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200383.WMF 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\Stationery\1033\SEAMARBL.HTM.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.DEV.HXS.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\default_apps\drive.crx.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105600.WMF 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0297757.WMF 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSPUB.OPG.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR46B.GIF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Perth.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01126_.WMF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Teal.css.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SOA.DLL 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14711_.GIF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\7-Zip\Lang\fr.txt.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.FR.XML.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Response.gif.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SPACER.GIF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\WISC30.DLL 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00013_.WMF 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\Office14\FORMS\1033\EXITEM.CFG.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Sybase.xsl 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CMNTY_01.MID 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21495_.GIF 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL.id-8BC377C6.[smith11@keemail.me].Aim 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1588 vssadmin.exe 884 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 250 IoCs
Processes:
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exepid process 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2028 vssvc.exe Token: SeRestorePrivilege 2028 vssvc.exe Token: SeAuditPrivilege 2028 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.execmd.execmd.exedescription pid process target process PID 896 wrote to memory of 1512 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe cmd.exe PID 896 wrote to memory of 1512 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe cmd.exe PID 896 wrote to memory of 1512 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe cmd.exe PID 896 wrote to memory of 1512 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe cmd.exe PID 1512 wrote to memory of 1764 1512 cmd.exe mode.com PID 1512 wrote to memory of 1764 1512 cmd.exe mode.com PID 1512 wrote to memory of 1764 1512 cmd.exe mode.com PID 1512 wrote to memory of 1588 1512 cmd.exe vssadmin.exe PID 1512 wrote to memory of 1588 1512 cmd.exe vssadmin.exe PID 1512 wrote to memory of 1588 1512 cmd.exe vssadmin.exe PID 896 wrote to memory of 972 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe cmd.exe PID 896 wrote to memory of 972 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe cmd.exe PID 896 wrote to memory of 972 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe cmd.exe PID 896 wrote to memory of 972 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe cmd.exe PID 972 wrote to memory of 1140 972 cmd.exe mode.com PID 972 wrote to memory of 1140 972 cmd.exe mode.com PID 972 wrote to memory of 1140 972 cmd.exe mode.com PID 972 wrote to memory of 884 972 cmd.exe vssadmin.exe PID 972 wrote to memory of 884 972 cmd.exe vssadmin.exe PID 972 wrote to memory of 884 972 cmd.exe vssadmin.exe PID 896 wrote to memory of 1172 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe mshta.exe PID 896 wrote to memory of 1172 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe mshta.exe PID 896 wrote to memory of 1172 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe mshta.exe PID 896 wrote to memory of 1172 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe mshta.exe PID 896 wrote to memory of 364 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe mshta.exe PID 896 wrote to memory of 364 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe mshta.exe PID 896 wrote to memory of 364 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe mshta.exe PID 896 wrote to memory of 364 896 4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe"C:\Users\Admin\AppData\Local\Temp\4b6de6cf9a91af3abf522643cb138747725ec1ae47d1defd66488e246a1fec8d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
-
memory/364-24-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB
-
memory/364-7-0x0000000000000000-mapping.dmp
-
memory/884-5-0x0000000000000000-mapping.dmp
-
memory/972-3-0x0000000000000000-mapping.dmp
-
memory/1140-4-0x0000000000000000-mapping.dmp
-
memory/1172-6-0x0000000000000000-mapping.dmp
-
memory/1172-27-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB
-
memory/1512-0-0x0000000000000000-mapping.dmp
-
memory/1588-2-0x0000000000000000-mapping.dmp
-
memory/1592-10-0x000007FEF7B70000-0x000007FEF7DEA000-memory.dmpFilesize
2.5MB
-
memory/1764-1-0x0000000000000000-mapping.dmp