Analysis
-
max time kernel
152s -
max time network
38s -
platform
windows7_x64 -
resource
win7 -
submitted
16-10-2020 16:36
Static task
static1
Behavioral task
behavioral1
Sample
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe
Resource
win10v200722
General
-
Target
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe
-
Size
92KB
-
MD5
ac87d0da39d6421dca7527172c30d069
-
SHA1
46fbe820362e9d79ae17ce16e40ce26aaa94bbe0
-
SHA256
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43
-
SHA512
55ef2b122d5d3e360eca515248bb785c64006cc7ef9c18565426e4500054ca781a5f6f6ac276d4cff39fd9b21bc190df5fd84c83d0bcd1e34cbdd8220d7f27ae
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
god@aolonline.top
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
god@aolonline.top
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\DismountEdit.tiff 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe -
Drops startup file 5 IoCs
Processes:
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe = "C:\\Windows\\System32\\5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe" 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe -
Drops desktop.ini file(s) 77 IoCs
Processes:
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SX06NR\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1MJ70CPH\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVV7BJHB\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe -
Drops file in System32 directory 2 IoCs
Processes:
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exedescription ioc process File created C:\Windows\System32\5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Windows\System32\Info.hta 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Drops file in Program Files directory 27785 IoCs
Processes:
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15072_.GIF 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21324_.GIF 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\TOC98.POC 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_m.png 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.CGM.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00255_.WMF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDCNCLL.ICO.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\StatusOnline.ico.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107512.WMF 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Mozilla Firefox\mozglue.dll.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115864.GIF 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\hr.pak.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\1033\PPINTL.REST.IDX_DLL.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIconsMask.bmp.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGLOGO.XML.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT.DEV_COL.HXC 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\ADDINS\MSSPC.ECF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART12.BDR 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\MSN.ICO.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\notConnectedStateIcon.png 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185806.WMF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0301052.WMF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21300_.GIF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14538_.GIF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\TAB_ON.GIF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\fr.pak.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\THMBNAIL.PNG.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\desktop.ini 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\EMAIL.DPV.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN054.XML.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15170_.GIF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE.MANIFEST 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHighMask.bmp.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\meta-index.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\PREVIEW.GIF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe File created C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF.id-919FE691.[god@aolonline.top].arena 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1612 vssadmin.exe 1688 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 252 IoCs
Processes:
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exepid process 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2000 vssvc.exe Token: SeRestorePrivilege 2000 vssvc.exe Token: SeAuditPrivilege 2000 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.execmd.execmd.exedescription pid process target process PID 1424 wrote to memory of 1476 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe cmd.exe PID 1424 wrote to memory of 1476 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe cmd.exe PID 1424 wrote to memory of 1476 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe cmd.exe PID 1424 wrote to memory of 1476 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe cmd.exe PID 1476 wrote to memory of 1528 1476 cmd.exe mode.com PID 1476 wrote to memory of 1528 1476 cmd.exe mode.com PID 1476 wrote to memory of 1528 1476 cmd.exe mode.com PID 1476 wrote to memory of 1612 1476 cmd.exe vssadmin.exe PID 1476 wrote to memory of 1612 1476 cmd.exe vssadmin.exe PID 1476 wrote to memory of 1612 1476 cmd.exe vssadmin.exe PID 1424 wrote to memory of 1308 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe cmd.exe PID 1424 wrote to memory of 1308 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe cmd.exe PID 1424 wrote to memory of 1308 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe cmd.exe PID 1424 wrote to memory of 1308 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe cmd.exe PID 1308 wrote to memory of 1540 1308 cmd.exe mode.com PID 1308 wrote to memory of 1540 1308 cmd.exe mode.com PID 1308 wrote to memory of 1540 1308 cmd.exe mode.com PID 1308 wrote to memory of 1688 1308 cmd.exe vssadmin.exe PID 1308 wrote to memory of 1688 1308 cmd.exe vssadmin.exe PID 1308 wrote to memory of 1688 1308 cmd.exe vssadmin.exe PID 1424 wrote to memory of 1984 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe mshta.exe PID 1424 wrote to memory of 1984 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe mshta.exe PID 1424 wrote to memory of 1984 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe mshta.exe PID 1424 wrote to memory of 1984 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe mshta.exe PID 1424 wrote to memory of 984 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe mshta.exe PID 1424 wrote to memory of 984 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe mshta.exe PID 1424 wrote to memory of 984 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe mshta.exe PID 1424 wrote to memory of 984 1424 5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe"C:\Users\Admin\AppData\Local\Temp\5a0d1265d52d2f76dae31aab48b706a72f03078a6111694f59c4ebf06e6e9f43.bin.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
c4e5df1d0ab61897550d698bd0d0a9ce
SHA144338888c306d641bece127a2a7c1a63dba0022a
SHA2560a3f2450db38c91c317e8855e876eb831cfa37bdc4611474abaeeae66a238a18
SHA512ea20539c77ca91eb71a55649de49c59dd4930736ac96632426b9eefe714a2d9ea8d5d9f4623a189d84e438c6734b7a4800dfcb54da47d29d27af35fd7a4db5c6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
c4e5df1d0ab61897550d698bd0d0a9ce
SHA144338888c306d641bece127a2a7c1a63dba0022a
SHA2560a3f2450db38c91c317e8855e876eb831cfa37bdc4611474abaeeae66a238a18
SHA512ea20539c77ca91eb71a55649de49c59dd4930736ac96632426b9eefe714a2d9ea8d5d9f4623a189d84e438c6734b7a4800dfcb54da47d29d27af35fd7a4db5c6
-
memory/984-7-0x0000000000000000-mapping.dmp
-
memory/984-26-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB
-
memory/1308-3-0x0000000000000000-mapping.dmp
-
memory/1476-0-0x0000000000000000-mapping.dmp
-
memory/1528-1-0x0000000000000000-mapping.dmp
-
memory/1540-4-0x0000000000000000-mapping.dmp
-
memory/1552-10-0x000007FEF80C0000-0x000007FEF833A000-memory.dmpFilesize
2.5MB
-
memory/1612-2-0x0000000000000000-mapping.dmp
-
memory/1688-5-0x0000000000000000-mapping.dmp
-
memory/1984-6-0x0000000000000000-mapping.dmp
-
memory/1984-25-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB