Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-04-2021 06:56
Static task
static1
Behavioral task
behavioral1
Sample
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe
Resource
win10v20201028
General
-
Target
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe
-
Size
92KB
-
MD5
627c54e435c997f228937d70fa4efabe
-
SHA1
de983ae81197370c1c0db019e47367ef0521163d
-
SHA256
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1
-
SHA512
c827d16c316ba46e5ed73018a73dc99c2e62a0c809aeb986027444a1d5d53e4c3fcb955152debc30bc69c82621eeb6ec454d6add17e5b2875cf3d25e325f0466
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
didoh@tutanota.com
enlist@criptext.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\BlockTest.tiff 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Pictures\EditRevoke.tiff 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Pictures\RemoveInstall.tiff 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Drops startup file 5 IoCs
Processes:
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe = "C:\\Windows\\System32\\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe" 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Music\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3341490333-719741536-2920803124-1000\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Drops file in System32 directory 2 IoCs
Processes:
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exedescription ioc process File created C:\Windows\System32\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Windows\System32\Info.hta 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.INF 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\nc_16x11.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\AppStore_icon.svg.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libps_plugin.dll.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\fonts\symbol.ttf 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkDrop32x32.gif 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\particles.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\en-il\ui-strings.js.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\cs-cz\ui-strings.js 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\PREVIEW.GIF.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\SkypeWideTile.scale-125_contrast-white.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-125.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\ui-strings.js 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\MapLightTheme.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell-2x.png.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\SmallTile.scale-100.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyResume.dotx.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_18.svg.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\Locales\pl.pak.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\ui-strings.js.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\az_60x42.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\4774_48x48x32.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-150.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-tool-view.js 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\PREVIEW.GIF.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Windows Defender\NisWfp.dll.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.access.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ui-strings.js.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7205_32x32x32.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.ELM 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\ui-strings.js.id-D68EB3F4.[didoh@tutanota.com].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2764 vssadmin.exe 3140 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exepid process 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 940 vssvc.exe Token: SeRestorePrivilege 940 vssvc.exe Token: SeAuditPrivilege 940 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.execmd.execmd.exedescription pid process target process PID 3884 wrote to memory of 1480 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe cmd.exe PID 3884 wrote to memory of 1480 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe cmd.exe PID 1480 wrote to memory of 3948 1480 cmd.exe mode.com PID 1480 wrote to memory of 3948 1480 cmd.exe mode.com PID 1480 wrote to memory of 2764 1480 cmd.exe vssadmin.exe PID 1480 wrote to memory of 2764 1480 cmd.exe vssadmin.exe PID 3884 wrote to memory of 256 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe cmd.exe PID 3884 wrote to memory of 256 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe cmd.exe PID 256 wrote to memory of 1772 256 cmd.exe mode.com PID 256 wrote to memory of 1772 256 cmd.exe mode.com PID 256 wrote to memory of 3140 256 cmd.exe vssadmin.exe PID 256 wrote to memory of 3140 256 cmd.exe vssadmin.exe PID 3884 wrote to memory of 4044 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe mshta.exe PID 3884 wrote to memory of 4044 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe mshta.exe PID 3884 wrote to memory of 3736 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe mshta.exe PID 3884 wrote to memory of 3736 3884 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe"C:\Users\Admin\AppData\Local\Temp\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
ffd6df00b3f71743c11b7ac3714c878a
SHA10a9317a2336b2e2f82923cfd58428b894fb33883
SHA256daad5a256da929ddf95c5632fef0d1f9dead692c397fdf301c8ad1c60760791d
SHA5122485923881caaaeeebf9559316e39a6ae67e1fe47205294d95096cdb5f67372131a6444a879c616bdfdffc79f73289c9c34100973b9c71038d1519db611cc7b0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
ffd6df00b3f71743c11b7ac3714c878a
SHA10a9317a2336b2e2f82923cfd58428b894fb33883
SHA256daad5a256da929ddf95c5632fef0d1f9dead692c397fdf301c8ad1c60760791d
SHA5122485923881caaaeeebf9559316e39a6ae67e1fe47205294d95096cdb5f67372131a6444a879c616bdfdffc79f73289c9c34100973b9c71038d1519db611cc7b0
-
memory/256-5-0x0000000000000000-mapping.dmp
-
memory/1480-2-0x0000000000000000-mapping.dmp
-
memory/1772-6-0x0000000000000000-mapping.dmp
-
memory/2764-4-0x0000000000000000-mapping.dmp
-
memory/3140-7-0x0000000000000000-mapping.dmp
-
memory/3736-9-0x0000000000000000-mapping.dmp
-
memory/3948-3-0x0000000000000000-mapping.dmp
-
memory/4044-8-0x0000000000000000-mapping.dmp