Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:45
Static task
static1
Behavioral task
behavioral1
Sample
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe
Resource
win10v20201028
General
-
Target
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe
-
Size
236KB
-
MD5
09fd8604639fa6f0d6a0d2a844c82ce8
-
SHA1
504ca88eedfe15fb00ce39e0b2c0522b5e90a2ac
-
SHA256
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686
-
SHA512
057985b4d27ffa8097dc0537fa2ad42d9d137d7ef69b1e753c1fa3a8f7c2f42903291e9ce6c40170443ffff90e8d9ffd5b73e96f1f6f5b311e316669474d1da2
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
3441546223@qq.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\FindAssert.tiff 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Pictures\MergeRequest.tiff 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Drops startup file 5 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe = "C:\\Windows\\System32\\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe" 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Drops desktop.ini file(s) 70 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Documents\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Videos\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Music\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Music\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Links\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Public\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Drops file in System32 directory 2 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File created C:\Windows\System32\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Windows\System32\Info.hta 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription pid process target process PID 644 set thread context of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Drops file in Program Files directory 35375 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\ui-strings.js.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsMedTile.scale-125.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-white_scale-200.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_contrast-black.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\mask\13d.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\LargeTile.scale-200.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-48.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-80_altform-unplated.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\cv_16x11.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\MedTile.scale-100.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.16112.11601.0_neutral_resources.scale-125_8wekyb3d8bbwe\Assets\LargeLogo.scale-125.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\ui-strings.js.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\_Resources\9.rsrc 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\3007_32x32x32.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\MedTile.scale-125.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF@3x.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5511_32x32x32.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Awards\Assets\awards_corner_gray.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-print.jar 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-40_altform-unplated_contrast-white.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_radio_selected_18.svg 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-default_32.svg.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Google\Temp\GUMED0D.tmp\GoogleUpdateSetup.exe.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\chstic.dgml 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\ui-strings.js.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36_altform-unplated_contrast-white.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32_contrast-white.png 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll.id-65358199.[3441546223@qq.com].ncov 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2324 vssadmin.exe 4036 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 373 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exepid process 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exevssvc.exedescription pid process Token: SeDebugPrivilege 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe Token: SeBackupPrivilege 2700 vssvc.exe Token: SeRestorePrivilege 2700 vssvc.exe Token: SeAuditPrivilege 2700 vssvc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.execmd.execmd.exedescription pid process target process PID 644 wrote to memory of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 644 wrote to memory of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 644 wrote to memory of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 644 wrote to memory of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 644 wrote to memory of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 644 wrote to memory of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 644 wrote to memory of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 644 wrote to memory of 2268 644 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe PID 2268 wrote to memory of 2912 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 2268 wrote to memory of 2912 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 2912 wrote to memory of 2128 2912 cmd.exe mode.com PID 2912 wrote to memory of 2128 2912 cmd.exe mode.com PID 2912 wrote to memory of 2324 2912 cmd.exe vssadmin.exe PID 2912 wrote to memory of 2324 2912 cmd.exe vssadmin.exe PID 2268 wrote to memory of 2088 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 2268 wrote to memory of 2088 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe cmd.exe PID 2088 wrote to memory of 2444 2088 cmd.exe mode.com PID 2088 wrote to memory of 2444 2088 cmd.exe mode.com PID 2088 wrote to memory of 4036 2088 cmd.exe vssadmin.exe PID 2088 wrote to memory of 4036 2088 cmd.exe vssadmin.exe PID 2268 wrote to memory of 1212 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 2268 wrote to memory of 1212 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 2268 wrote to memory of 1216 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe PID 2268 wrote to memory of 1216 2268 45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe"C:\Users\Admin\AppData\Local\Temp\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe"C:/Users/Admin/AppData/Local/Temp/45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe"2⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
d6d790ce5cea2e54b34d283a1b73e244
SHA1ef9340aad951d77f8a7e217a1b9118561371d3ce
SHA25623fe1001f7e37b2372590b4306b83e77d976eb2ec1930b7c5c6b9c481a4cdddf
SHA512e028ee7e11018c9cf961edd643be799b80be95e3d3324a50cb6f091c2310a530436bcb89537b22b45e4f3d2bef3c02aaf7e315cfd357f641fd8f49d956db0468
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686.exe.logMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeMD5
fcb2de9b597d72e002ca26cdee1886af
SHA1eb00d1b115ddfd9d66fd040d0ca8b5953830dbc1
SHA256ee2b863ef43a3b712b256c7bffaffea16d3dddb447f3c6cfc6e98267e105d54f
SHA51238723340044ea62169101158dab0f2c82fa143368e902aa353ff12d4c549104cd2badcbab43aa310e46b9c7082d9f59b7a84105cfd6ee7f97799a7ea97421cc8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
d6d790ce5cea2e54b34d283a1b73e244
SHA1ef9340aad951d77f8a7e217a1b9118561371d3ce
SHA25623fe1001f7e37b2372590b4306b83e77d976eb2ec1930b7c5c6b9c481a4cdddf
SHA512e028ee7e11018c9cf961edd643be799b80be95e3d3324a50cb6f091c2310a530436bcb89537b22b45e4f3d2bef3c02aaf7e315cfd357f641fd8f49d956db0468
-
memory/644-1-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/644-3-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/644-4-0x0000000004CC0000-0x0000000004CDB000-memory.dmpFilesize
108KB
-
memory/644-0-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/1212-16-0x0000000000000000-mapping.dmp
-
memory/1216-18-0x0000000000000000-mapping.dmp
-
memory/2088-13-0x0000000000000000-mapping.dmp
-
memory/2128-9-0x0000000000000000-mapping.dmp
-
memory/2268-7-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2268-6-0x000000000040A9D0-mapping.dmp
-
memory/2268-5-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2324-10-0x0000000000000000-mapping.dmp
-
memory/2444-14-0x0000000000000000-mapping.dmp
-
memory/2912-8-0x0000000000000000-mapping.dmp
-
memory/4036-15-0x0000000000000000-mapping.dmp