Analysis
-
max time kernel
151s -
max time network
30s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-05-2021 03:17
Static task
static1
Behavioral task
behavioral1
Sample
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe
Resource
win10v20210410
General
-
Target
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe
-
Size
199KB
-
MD5
c783ad4101e1020254cdc16052e6d616
-
SHA1
71273fabc2235c031220c2d512fef9969bc21435
-
SHA256
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e
-
SHA512
6dec3e2c50a08485ce6f016c77e79a8f240e841233a88e9520d8fa10fb20cbfc42695a821e11db59bd870b3a98ae53f06c0bcc5a091819f6beea2238f051c781
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@sectex.net
admin@sectex.world
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe = "C:\\Windows\\System32\\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe" e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Videos\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SLC8MVWU\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\93PHUZFG\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XVLP3GFJ\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Desktop\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Music\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Documents\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Documents\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Libraries\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Videos\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Downloads\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Music\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2MTLR0RV\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Pictures\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MLS6OOW4\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQE06QBJ\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Searches\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Drops file in System32 directory 2 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process File created C:\Windows\System32\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Windows\System32\Info.hta e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process File opened for modification C:\Program Files\Java\jre7\bin\server\classes.jsa e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chicago e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0279644.WMF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay.css e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHMAIN.DLL.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02742U.BMP e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18234_.WMF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00525_.WMF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18211_.WMF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\MSB1ENES.ITS e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cayenne.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107748.WMF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jre7\lib\tzmappings.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14830_.GIF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.DPV e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01548_.WMF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107150.WMF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00177_.WMF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107258.WMF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOCS.ICO.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESPL.ICO.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FORM.ICO.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03012U.BMP.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.DPV e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKDECL.ICO e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01300_.GIF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Austin.eftx.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ENVELOPR.DLL.IDX_DLL.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282126.WMF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.CSS.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR43B.GIF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00820_.WMF e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297551.WMF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212299.WMF.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Paris e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382942.JPG.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanReport.Dotx.id-6ADC1E08.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1444 vssadmin.exe 600 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exepid process 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1684 vssvc.exe Token: SeRestorePrivilege 1684 vssvc.exe Token: SeAuditPrivilege 1684 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.execmd.execmd.exedescription pid process target process PID 1084 wrote to memory of 2024 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 1084 wrote to memory of 2024 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 1084 wrote to memory of 2024 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 1084 wrote to memory of 2024 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 2024 wrote to memory of 1520 2024 cmd.exe mode.com PID 2024 wrote to memory of 1520 2024 cmd.exe mode.com PID 2024 wrote to memory of 1520 2024 cmd.exe mode.com PID 2024 wrote to memory of 1444 2024 cmd.exe vssadmin.exe PID 2024 wrote to memory of 1444 2024 cmd.exe vssadmin.exe PID 2024 wrote to memory of 1444 2024 cmd.exe vssadmin.exe PID 1084 wrote to memory of 1708 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 1084 wrote to memory of 1708 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 1084 wrote to memory of 1708 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 1084 wrote to memory of 1708 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 1708 wrote to memory of 1308 1708 cmd.exe mode.com PID 1708 wrote to memory of 1308 1708 cmd.exe mode.com PID 1708 wrote to memory of 1308 1708 cmd.exe mode.com PID 1708 wrote to memory of 600 1708 cmd.exe vssadmin.exe PID 1708 wrote to memory of 600 1708 cmd.exe vssadmin.exe PID 1708 wrote to memory of 600 1708 cmd.exe vssadmin.exe PID 1084 wrote to memory of 1472 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 1084 wrote to memory of 1472 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 1084 wrote to memory of 1472 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 1084 wrote to memory of 1472 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 1084 wrote to memory of 212 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 1084 wrote to memory of 212 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 1084 wrote to memory of 212 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 1084 wrote to memory of 212 1084 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe"C:\Users\Admin\AppData\Local\Temp\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
a49e559868c2d0af2f5499f0f00cbee1
SHA1728e25cdd8b606ed582d6cc3334c3caec9b58ad4
SHA256f60ff61e71d0e3c4d838c5d707e128348688b3f7ada1f65e0b29677c3c337a51
SHA512b26b727f05593a75de98104695f111d2fc9ec70cd5c5446231e083d02c02626ef32ddb31de3d691d25b0cd31a4fbea12519e180ca497a32b13b584186416500d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
a49e559868c2d0af2f5499f0f00cbee1
SHA1728e25cdd8b606ed582d6cc3334c3caec9b58ad4
SHA256f60ff61e71d0e3c4d838c5d707e128348688b3f7ada1f65e0b29677c3c337a51
SHA512b26b727f05593a75de98104695f111d2fc9ec70cd5c5446231e083d02c02626ef32ddb31de3d691d25b0cd31a4fbea12519e180ca497a32b13b584186416500d
-
memory/212-70-0x0000000000000000-mapping.dmp
-
memory/600-68-0x0000000000000000-mapping.dmp
-
memory/1084-60-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB
-
memory/1084-64-0x00000000002A0000-0x00000000002B9000-memory.dmpFilesize
100KB
-
memory/1084-65-0x0000000000400000-0x0000000006C19000-memory.dmpFilesize
104.1MB
-
memory/1308-67-0x0000000000000000-mapping.dmp
-
memory/1444-63-0x0000000000000000-mapping.dmp
-
memory/1472-69-0x0000000000000000-mapping.dmp
-
memory/1520-62-0x0000000000000000-mapping.dmp
-
memory/1708-66-0x0000000000000000-mapping.dmp
-
memory/2024-61-0x0000000000000000-mapping.dmp