Analysis
-
max time kernel
152s -
max time network
128s -
platform
windows7_x64 -
resource
win7 -
submitted
16-10-2020 16:36
Static task
static1
Behavioral task
behavioral1
Sample
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe
Resource
win10
General
-
Target
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe
-
Size
92KB
-
MD5
c8ebe6f4b11dbc59aade73500887c200
-
SHA1
ab1750df17d1a2ccc992833550eacac199e47a7d
-
SHA256
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5
-
SHA512
687e0ed5d0f777ff77ee36f341f176cdd25136e82e5d79a0b4f20c19d375841c62adf7dfe9c0742b874d8cc7f12ad2487040761095a2c513c0c0ed6b0e72fe30
Malware Config
Extracted
C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
backmydata2@protonmail.com
backmydata2@airmail.cc
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
backmydata2@protonmail.com
backmydata2@airmail.cc
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe = "C:\\Windows\\System32\\2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe" 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe -
Drops desktop.ini file(s) 77 IoCs
Processes:
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SX06NR\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1MJ70CPH\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OLSU73OI\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVV7BJHB\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe -
Drops file in System32 directory 2 IoCs
Processes:
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exedescription ioc process File created C:\Windows\System32\2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Windows\System32\Info.hta 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Drops file in Program Files directory 27807 IoCs
Processes:
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exedescription ioc process File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\XMLSDK5.CHM.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONENOTEIRM.XML 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\VVIEWRES.DLL.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jre7\bin\j2pcsc.dll 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00633_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\Office14\CONVERT\PAB.SAM.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18249_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00098_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Java\jre7\bin\splashscreen.dll.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\MENU98.POC.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR00.GIF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA01357_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR23F.GIF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\master_preferences.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine.dll.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14529_.GIF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLASSIC2.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BORDERS\MSART13.BDR.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\WSIDBR98.POC.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterToolTemplates.xml.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\SkipFormat.svgz.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107712.WMF 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153305.WMF 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA00458_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Java\jre7\bin\jfxmedia.dll.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.DEV_COL.HXT 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\DVD Maker\offset.ax 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImagesMask.bmp 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18218_.WMF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\LTHD98SP.POC 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\PREVIEW.GIF.id-794ECF81.[backmydata2@protonmail.com].bmd 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0195534.WMF 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1808 vssadmin.exe 1068 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 251 IoCs
Processes:
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exepid process 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1580 vssvc.exe Token: SeRestorePrivilege 1580 vssvc.exe Token: SeAuditPrivilege 1580 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.execmd.execmd.exedescription pid process target process PID 1752 wrote to memory of 1920 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe cmd.exe PID 1752 wrote to memory of 1920 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe cmd.exe PID 1752 wrote to memory of 1920 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe cmd.exe PID 1752 wrote to memory of 1920 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe cmd.exe PID 1920 wrote to memory of 1144 1920 cmd.exe mode.com PID 1920 wrote to memory of 1144 1920 cmd.exe mode.com PID 1920 wrote to memory of 1144 1920 cmd.exe mode.com PID 1920 wrote to memory of 1808 1920 cmd.exe vssadmin.exe PID 1920 wrote to memory of 1808 1920 cmd.exe vssadmin.exe PID 1920 wrote to memory of 1808 1920 cmd.exe vssadmin.exe PID 1752 wrote to memory of 852 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe cmd.exe PID 1752 wrote to memory of 852 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe cmd.exe PID 1752 wrote to memory of 852 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe cmd.exe PID 1752 wrote to memory of 852 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe cmd.exe PID 852 wrote to memory of 1196 852 cmd.exe mode.com PID 852 wrote to memory of 1196 852 cmd.exe mode.com PID 852 wrote to memory of 1196 852 cmd.exe mode.com PID 1752 wrote to memory of 1524 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe mshta.exe PID 1752 wrote to memory of 1524 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe mshta.exe PID 1752 wrote to memory of 1524 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe mshta.exe PID 1752 wrote to memory of 1524 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe mshta.exe PID 852 wrote to memory of 1068 852 cmd.exe vssadmin.exe PID 852 wrote to memory of 1068 852 cmd.exe vssadmin.exe PID 852 wrote to memory of 1068 852 cmd.exe vssadmin.exe PID 1752 wrote to memory of 1244 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe mshta.exe PID 1752 wrote to memory of 1244 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe mshta.exe PID 1752 wrote to memory of 1244 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe mshta.exe PID 1752 wrote to memory of 1244 1752 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe"C:\Users\Admin\AppData\Local\Temp\2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
014af920fb895eb86d970b652f3c920b
SHA1c268581f70fa0193e38a5e55eb9b4aae81827b64
SHA25691c55be206c90dd60a0d0251fa8ea37223d2535d4f0d92d8abd642a140707d6f
SHA512743b6f04592d1e68b4ebea7adb9992b9d8e73279fe778bbbb7fdffccb6fd87521208b3af1257301a190788875518bffd50c83fc9c4f63f7171ec4199c52cbf4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
014af920fb895eb86d970b652f3c920b
SHA1c268581f70fa0193e38a5e55eb9b4aae81827b64
SHA25691c55be206c90dd60a0d0251fa8ea37223d2535d4f0d92d8abd642a140707d6f
SHA512743b6f04592d1e68b4ebea7adb9992b9d8e73279fe778bbbb7fdffccb6fd87521208b3af1257301a190788875518bffd50c83fc9c4f63f7171ec4199c52cbf4a
-
memory/852-3-0x0000000000000000-mapping.dmp
-
memory/1068-6-0x0000000000000000-mapping.dmp
-
memory/1144-1-0x0000000000000000-mapping.dmp
-
memory/1196-4-0x0000000000000000-mapping.dmp
-
memory/1224-10-0x000007FEF6F00000-0x000007FEF717A000-memory.dmpFilesize
2.5MB
-
memory/1244-7-0x0000000000000000-mapping.dmp
-
memory/1524-5-0x0000000000000000-mapping.dmp
-
memory/1808-2-0x0000000000000000-mapping.dmp
-
memory/1920-0-0x0000000000000000-mapping.dmp