Analysis
-
max time kernel
150s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:45
Static task
static1
Behavioral task
behavioral1
Sample
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe
Resource
win10v20201028
General
-
Target
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe
-
Size
236KB
-
MD5
09fd8604639fa6f0d6a0d2a844c82ce8
-
SHA1
504ca88eedfe15fb00ce39e0b2c0522b5e90a2ac
-
SHA256
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686
-
SHA512
057985b4d27ffa8097dc0537fa2ad42d9d137d7ef69b1e753c1fa3a8f7c2f42903291e9ce6c40170443ffff90e8d9ffd5b73e96f1f6f5b311e316669474d1da2
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
3441546223@qq.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe = "C:\\Windows\\System32\\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe" 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Drops desktop.ini file(s) 77 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Music\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F6O5NPVK\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M1AZJ0WQ\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8DDKLDOL\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AT22T7OH\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Documents\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F6QQJELO\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Music\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Videos\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Drops file in System32 directory 2 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File created C:\Windows\System32\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Windows\System32\Info.hta 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription pid process target process PID 292 set thread context of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Drops file in Program Files directory 27839 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\St_Johns.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00334_.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01575_.WMF 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_ON.GIF 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl.css.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Solstice.xml.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153093.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_COL.HXT 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.ICO 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18221_.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_pressed.gif.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099192.GIF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382958.JPG.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.LEX.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.ELM 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\PREVIEW.GIF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382947.JPG.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jre7\lib\zi\America\Vancouver.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OOFL.ICO.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Paris 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04269_.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107458.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jre7\lib\javaws.jar 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00641_.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00052_.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00792_.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\BUTTON.GIF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECRECL.ICO.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198016.WMF 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103402.WMF.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Eucla 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGATNGET.XML 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe.id-51C7BEB4.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145879.JPG 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241037.WMF 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1052 vssadmin.exe 904 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 165 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exepid process 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exevssvc.exedescription pid process Token: SeDebugPrivilege 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe Token: SeBackupPrivilege 560 vssvc.exe Token: SeRestorePrivilege 560 vssvc.exe Token: SeAuditPrivilege 560 vssvc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.execmd.execmd.exedescription pid process target process PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 292 wrote to memory of 1348 292 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 1348 wrote to memory of 1512 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 1348 wrote to memory of 1512 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 1348 wrote to memory of 1512 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 1348 wrote to memory of 1512 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 1512 wrote to memory of 328 1512 cmd.exe mode.com PID 1512 wrote to memory of 328 1512 cmd.exe mode.com PID 1512 wrote to memory of 328 1512 cmd.exe mode.com PID 1512 wrote to memory of 1052 1512 cmd.exe vssadmin.exe PID 1512 wrote to memory of 1052 1512 cmd.exe vssadmin.exe PID 1512 wrote to memory of 1052 1512 cmd.exe vssadmin.exe PID 1348 wrote to memory of 2028 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 1348 wrote to memory of 2028 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 1348 wrote to memory of 2028 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 1348 wrote to memory of 2028 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 2028 wrote to memory of 960 2028 cmd.exe mode.com PID 2028 wrote to memory of 960 2028 cmd.exe mode.com PID 2028 wrote to memory of 960 2028 cmd.exe mode.com PID 1348 wrote to memory of 940 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 1348 wrote to memory of 940 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 1348 wrote to memory of 940 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 1348 wrote to memory of 940 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 2028 wrote to memory of 904 2028 cmd.exe vssadmin.exe PID 2028 wrote to memory of 904 2028 cmd.exe vssadmin.exe PID 2028 wrote to memory of 904 2028 cmd.exe vssadmin.exe PID 1348 wrote to memory of 680 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 1348 wrote to memory of 680 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 1348 wrote to memory of 680 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 1348 wrote to memory of 680 1348 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe"C:\Users\Admin\AppData\Local\Temp\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe"C:/Users/Admin/AppData/Local/Temp/45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
cabaf2b8b14bc6c0f805914f881532cc
SHA13fca4bc265f5d8777dc1fc3da8690cbf82573e83
SHA25677a7e8e0187ce4f7506609c25914b241d767a5909b31a3dcfbae9e8a604d4ba3
SHA51276bcd6b9da363a6bbe690e17cc1d6b8d0b9d1655e07ee77eef4931ed96cdf8de97c373c50224fb12007f7f2e42a9e48c4e7d4a56b1c4b0a4b634303a039ed173
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeMD5
efe7f83fe680626f2c6485fe291d1946
SHA1e6660000842da2f5274f8798b1e2a5b6ae97ec40
SHA256f44f317169df398a253efd6c422a4008ec9957df06dbf2ebdd73113f8195d20d
SHA512ecc1966572cd200e2edc3cf03b1750a6ff8439d52375eab88f461e70ffd56b99b19200d2aa4b4b58f55b34ec07ca40ff25da571c33b8aa715b9384bad5bb56cd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
cabaf2b8b14bc6c0f805914f881532cc
SHA13fca4bc265f5d8777dc1fc3da8690cbf82573e83
SHA25677a7e8e0187ce4f7506609c25914b241d767a5909b31a3dcfbae9e8a604d4ba3
SHA51276bcd6b9da363a6bbe690e17cc1d6b8d0b9d1655e07ee77eef4931ed96cdf8de97c373c50224fb12007f7f2e42a9e48c4e7d4a56b1c4b0a4b634303a039ed173
-
memory/292-3-0x0000000000670000-0x000000000068B000-memory.dmpFilesize
108KB
-
memory/292-0-0x00000000748D0000-0x0000000074FBE000-memory.dmpFilesize
6.9MB
-
memory/292-1-0x0000000001380000-0x0000000001381000-memory.dmpFilesize
4KB
-
memory/328-8-0x0000000000000000-mapping.dmp
-
memory/680-34-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmpFilesize
64KB
-
memory/680-15-0x0000000000000000-mapping.dmp
-
memory/904-13-0x0000000000000000-mapping.dmp
-
memory/940-33-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmpFilesize
64KB
-
memory/940-14-0x0000000000000000-mapping.dmp
-
memory/960-12-0x0000000000000000-mapping.dmp
-
memory/1052-9-0x0000000000000000-mapping.dmp
-
memory/1348-6-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1348-4-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1348-5-0x000000000040A9D0-mapping.dmp
-
memory/1512-7-0x0000000000000000-mapping.dmp
-
memory/1992-18-0x000007FEF6580000-0x000007FEF67FA000-memory.dmpFilesize
2.5MB
-
memory/2028-11-0x0000000000000000-mapping.dmp