Analysis
-
max time kernel
151s -
max time network
52s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 12:05
Static task
static1
Behavioral task
behavioral1
Sample
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe
Resource
win10v20210408
General
-
Target
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe
-
Size
440KB
-
MD5
0bea574db74f33958723ea9a9bd81c11
-
SHA1
8ca2edc10ee3e13c3075baf8450d4d94b220c6e6
-
SHA256
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9
-
SHA512
5f71ca9ae881e59db1638883e42cbbc04b70b4ab1b98ec9632062229cbdcd6196e7889b9d304d10fc684fcbc468bf0a2a60e271c785fbeee2ebca7a2947f0272
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
datadecrypt@qq.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe = "C:\\Windows\\System32\\d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe" d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exedescription ioc process File opened for modification C:\Users\Admin\Links\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Public\Desktop\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Public\Videos\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files (x86)\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Public\Documents\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Music\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Public\Music\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Documents\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe -
Drops file in System32 directory 2 IoCs
Processes:
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exedescription ioc process File created C:\Windows\System32\d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Windows\System32\Info.hta d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Microsoft.People.Controls.winmd d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\trdtv2r41.xsl d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-100.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\ui-strings.js d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\15.jpg d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-400.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-100.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\7-Zip\Lang\vi.txt.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBOB6.CHM.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-fullcolor.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_altform-unplated.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ma_60x42.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-us\onintlim.dll d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7296_32x32x32.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\svgCheckboxUnselected.svg d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_EyeLashEye.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\jconsole.jar.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-black\Square44x44Logo.targetsize-256.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\ui-strings.js.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxManifest.xml d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\st_60x42.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\ui-strings.js.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\nashorn.jar.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\plugin.jar.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\ui-strings.js.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_MouseNose.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\bow.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.id-7C59B6D3.[datadecrypt@qq.com].ETH d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32_altform-unplated.png d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 856 vssadmin.exe 4064 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exepid process 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
AUDIODG.EXEd0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exevssvc.exedescription pid process Token: 33 3440 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3440 AUDIODG.EXE Token: 33 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe Token: SeIncBasePriorityPrivilege 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe Token: SeBackupPrivilege 612 vssvc.exe Token: SeRestorePrivilege 612 vssvc.exe Token: SeAuditPrivilege 612 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.execmd.execmd.exedescription pid process target process PID 804 wrote to memory of 808 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe cmd.exe PID 804 wrote to memory of 808 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe cmd.exe PID 808 wrote to memory of 2080 808 cmd.exe mode.com PID 808 wrote to memory of 2080 808 cmd.exe mode.com PID 808 wrote to memory of 856 808 cmd.exe vssadmin.exe PID 808 wrote to memory of 856 808 cmd.exe vssadmin.exe PID 804 wrote to memory of 4024 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe cmd.exe PID 804 wrote to memory of 4024 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe cmd.exe PID 4024 wrote to memory of 2120 4024 cmd.exe mode.com PID 4024 wrote to memory of 2120 4024 cmd.exe mode.com PID 4024 wrote to memory of 4064 4024 cmd.exe vssadmin.exe PID 4024 wrote to memory of 4064 4024 cmd.exe vssadmin.exe PID 804 wrote to memory of 3824 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe mshta.exe PID 804 wrote to memory of 3824 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe mshta.exe PID 804 wrote to memory of 3420 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe mshta.exe PID 804 wrote to memory of 3420 804 d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe"C:\Users\Admin\AppData\Local\Temp\d0f8c1a00ebbdfec24e2b4074515ebb5d1f22930f3cf828e728628326f315fd9.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
e8c48dfeb98371c8834f6780ef19ef5d
SHA17c2439fdd34943cef5062bf1e9bd734e064a2ddf
SHA256085ca245f9e875d88d9bbb14f765136621b389ed5e53bec8f8f0126d8f3b48fd
SHA51281da976ba4d3ed1d49f668761140c3b7e58aa8d8a7e747e43f07cce67def2f664e3d02fb3991bc8210e09bf79d2a91069b45c86405ed651e63492ec3f697f6ca
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
e8c48dfeb98371c8834f6780ef19ef5d
SHA17c2439fdd34943cef5062bf1e9bd734e064a2ddf
SHA256085ca245f9e875d88d9bbb14f765136621b389ed5e53bec8f8f0126d8f3b48fd
SHA51281da976ba4d3ed1d49f668761140c3b7e58aa8d8a7e747e43f07cce67def2f664e3d02fb3991bc8210e09bf79d2a91069b45c86405ed651e63492ec3f697f6ca
-
memory/804-116-0x00000000024C0000-0x0000000002540000-memory.dmpFilesize
512KB
-
memory/804-118-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB
-
memory/804-117-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/808-134-0x0000000000000000-mapping.dmp
-
memory/856-136-0x0000000000000000-mapping.dmp
-
memory/2080-135-0x0000000000000000-mapping.dmp
-
memory/2120-138-0x0000000000000000-mapping.dmp
-
memory/3420-141-0x0000000000000000-mapping.dmp
-
memory/3824-140-0x0000000000000000-mapping.dmp
-
memory/4024-137-0x0000000000000000-mapping.dmp
-
memory/4064-139-0x0000000000000000-mapping.dmp