Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
17-05-2021 10:10
Static task
static1
Behavioral task
behavioral1
Sample
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe
Resource
win10v20210410
General
-
Target
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe
-
Size
133KB
-
MD5
d64be1cf64058aba02cb98065d5ea3f0
-
SHA1
fbcc5a7492f6bcbc86f36fd191df038f6f6660d0
-
SHA256
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9
-
SHA512
549640e2c68692e77593b31abf2ab9cd407d8e87190096faa566d9b3d84c9ec35c66ea0d41460446ea9f469067582588af219e8dce7342ea7bfad53be192aba9
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
cryptohelp24@cock.li
cryptocompany24@cock.li
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\OptimizeUse.tiff db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe -
Drops startup file 5 IoCs
Processes:
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe = "C:\\Windows\\System32\\db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe" db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exedescription ioc process File opened for modification C:\Program Files\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\Videos\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Documents\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\Desktop\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\Downloads\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Links\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\Documents\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Music\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\Music\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Videos\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Searches\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\Pictures\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Users\Public\Libraries\desktop.ini db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe -
Drops file in System32 directory 2 IoCs
Processes:
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exedescription ioc process File created C:\Windows\System32\db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Windows\System32\Info.hta db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe -
Drops file in Program Files directory 64 IoCs
Processes:
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\ui-strings.js.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-32.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\common.lua db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-40_altform-unplated_contrast-white.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\190.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyclient.jar.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\OneConnectLargeTile.scale-125.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\PortalConnect.dll.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_it_135x40.svg db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.VideoTk\ContrastEffectPS_BGRA.cso db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBUI6.CHM.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\ui-strings.js.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\ui-strings.js.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Windows Defender\DbgHelp.dll db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\models\fr-FR.PhoneNumber.model db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\jawt.dll.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\LobbyTiles\Tripeaks_bp_809.jpg db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-default_32.svg.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSLID.DLL db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Set-TestInconclusive.ps1 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fr.dll db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview_selected.svg.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\Assets\Images\Tiles\Square44x44Logo.targetsize-24_altform-unplated.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OneConnectAppList.targetsize-256.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\envy.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200.png db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\download.svg.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\ui-strings.js.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.id-B6333937.[cryptohelp24@cock.li].harma db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\resources.pri db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1104 vssadmin.exe 1848 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exepid process 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2804 vssvc.exe Token: SeRestorePrivilege 2804 vssvc.exe Token: SeAuditPrivilege 2804 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.execmd.execmd.exedescription pid process target process PID 3212 wrote to memory of 1956 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe cmd.exe PID 3212 wrote to memory of 1956 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe cmd.exe PID 1956 wrote to memory of 184 1956 cmd.exe mode.com PID 1956 wrote to memory of 184 1956 cmd.exe mode.com PID 1956 wrote to memory of 1104 1956 cmd.exe vssadmin.exe PID 1956 wrote to memory of 1104 1956 cmd.exe vssadmin.exe PID 3212 wrote to memory of 2240 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe cmd.exe PID 3212 wrote to memory of 2240 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe cmd.exe PID 2240 wrote to memory of 200 2240 cmd.exe mode.com PID 2240 wrote to memory of 200 2240 cmd.exe mode.com PID 2240 wrote to memory of 1848 2240 cmd.exe vssadmin.exe PID 2240 wrote to memory of 1848 2240 cmd.exe vssadmin.exe PID 3212 wrote to memory of 2076 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe mshta.exe PID 3212 wrote to memory of 2076 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe mshta.exe PID 3212 wrote to memory of 268 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe mshta.exe PID 3212 wrote to memory of 268 3212 db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe"C:\Users\Admin\AppData\Local\Temp\db87da4d68417d25dd5b53511a5596cce452cdb9ab38682dfa12d6d898c38ec9.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
57df7685176b3de65dc59d4469905a81
SHA16d3786a8347fec1e4a65df78fdbf46169c82090d
SHA256539c142c44c8b16053b1dffed6ffc1a2930690915e030a01c43a634824128760
SHA512e0a6ae06878373ff2e6b58624fecaa8cd921e645797fc43a867bc37ea0757384ad653337114ffd24657c6a2cd01b17ed43aff2148bad67e239cb34818702700f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
57df7685176b3de65dc59d4469905a81
SHA16d3786a8347fec1e4a65df78fdbf46169c82090d
SHA256539c142c44c8b16053b1dffed6ffc1a2930690915e030a01c43a634824128760
SHA512e0a6ae06878373ff2e6b58624fecaa8cd921e645797fc43a867bc37ea0757384ad653337114ffd24657c6a2cd01b17ed43aff2148bad67e239cb34818702700f
-
memory/184-115-0x0000000000000000-mapping.dmp
-
memory/200-118-0x0000000000000000-mapping.dmp
-
memory/268-121-0x0000000000000000-mapping.dmp
-
memory/1104-116-0x0000000000000000-mapping.dmp
-
memory/1848-119-0x0000000000000000-mapping.dmp
-
memory/1956-114-0x0000000000000000-mapping.dmp
-
memory/2076-120-0x0000000000000000-mapping.dmp
-
memory/2240-117-0x0000000000000000-mapping.dmp