Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-05-2021 03:17
Static task
static1
Behavioral task
behavioral1
Sample
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe
Resource
win10v20210410
General
-
Target
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe
-
Size
199KB
-
MD5
c783ad4101e1020254cdc16052e6d616
-
SHA1
71273fabc2235c031220c2d512fef9969bc21435
-
SHA256
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e
-
SHA512
6dec3e2c50a08485ce6f016c77e79a8f240e841233a88e9520d8fa10fb20cbfc42695a821e11db59bd870b3a98ae53f06c0bcc5a091819f6beea2238f051c781
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@sectex.net
admin@sectex.world
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe = "C:\\Windows\\System32\\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe" e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Documents\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Desktop\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Documents\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Videos\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Libraries\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Videos\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Links\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Music\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Searches\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Downloads\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Public\Pictures\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Users\Admin\Music\desktop.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Drops file in System32 directory 2 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process File created C:\Windows\System32\Info.hta e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Windows\System32\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exedescription ioc process File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\am.pak.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xeccf.png e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\ui-strings.js.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\ui-strings.js e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\AppxSignature.p7x e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforcomments_18.svg.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sv.dll.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\sr-latn-cs\mso.acl e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-disabled.svg.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main-selector.css e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\MAPISHELLR.DLL.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jre1.8.0_66\bin\msvcr120.dll.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\CardBacks\Beach.png e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-100.png e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_listview_18.svg.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\msvcr120.dll.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssv.dll.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mp_16x11.png e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\mlib_image.dll.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-125_contrast-white.png e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\plugin.js.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\ui-strings.js.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-hover.svg.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_18.svg.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ExpenseReport.xltx.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\ui-strings.js.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\shape_torus.3mf e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5606_40x40x32.png e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en.dll.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.id-36D6BFA2.[admin@sectex.net].bot e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\SmallTripeaksTile.jpg e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2804 vssadmin.exe 4048 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exepid process 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3076 vssvc.exe Token: SeRestorePrivilege 3076 vssvc.exe Token: SeAuditPrivilege 3076 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.execmd.execmd.exedescription pid process target process PID 4060 wrote to memory of 2784 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 4060 wrote to memory of 2784 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 2784 wrote to memory of 2668 2784 cmd.exe mode.com PID 2784 wrote to memory of 2668 2784 cmd.exe mode.com PID 2784 wrote to memory of 2804 2784 cmd.exe vssadmin.exe PID 2784 wrote to memory of 2804 2784 cmd.exe vssadmin.exe PID 4060 wrote to memory of 1780 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 4060 wrote to memory of 1780 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe cmd.exe PID 1780 wrote to memory of 2672 1780 cmd.exe mode.com PID 1780 wrote to memory of 2672 1780 cmd.exe mode.com PID 1780 wrote to memory of 4048 1780 cmd.exe vssadmin.exe PID 1780 wrote to memory of 4048 1780 cmd.exe vssadmin.exe PID 4060 wrote to memory of 2056 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 4060 wrote to memory of 2056 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 4060 wrote to memory of 1952 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe PID 4060 wrote to memory of 1952 4060 e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe"C:\Users\Admin\AppData\Local\Temp\e18bd7ac81dfb412a814dac8145674f748ee5b4d12801ec3bb6ea03cee27099e.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
cba674884e2524aa4e1b04d2400a6873
SHA1a64c1c99232d498f6fedc8e76e826a2cf1b82ac6
SHA2567c5279630f7a8d4bc15f8942b9f7fd81ba696ccfc87ccdbddda879a6abaeb111
SHA512bf6bc768a7460196bab5cc889be159d7523a3ce0a228dfc9d1749167b584ea4976e72c9ce6ff76e32256ec6694007a05e74efc1c6ceeb2be68d91c2bc10c0a12
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
cba674884e2524aa4e1b04d2400a6873
SHA1a64c1c99232d498f6fedc8e76e826a2cf1b82ac6
SHA2567c5279630f7a8d4bc15f8942b9f7fd81ba696ccfc87ccdbddda879a6abaeb111
SHA512bf6bc768a7460196bab5cc889be159d7523a3ce0a228dfc9d1749167b584ea4976e72c9ce6ff76e32256ec6694007a05e74efc1c6ceeb2be68d91c2bc10c0a12
-
memory/1780-119-0x0000000000000000-mapping.dmp
-
memory/1952-123-0x0000000000000000-mapping.dmp
-
memory/2056-122-0x0000000000000000-mapping.dmp
-
memory/2668-117-0x0000000000000000-mapping.dmp
-
memory/2672-120-0x0000000000000000-mapping.dmp
-
memory/2784-114-0x0000000000000000-mapping.dmp
-
memory/2804-118-0x0000000000000000-mapping.dmp
-
memory/4048-121-0x0000000000000000-mapping.dmp
-
memory/4060-115-0x0000000006C20000-0x0000000006D6A000-memory.dmpFilesize
1.3MB
-
memory/4060-116-0x0000000000400000-0x0000000006C19000-memory.dmpFilesize
104.1MB