Analysis
-
max time kernel
150s -
max time network
86s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
18-05-2021 02:37
Static task
static1
Behavioral task
behavioral1
Sample
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe
Resource
win10v20210408
General
-
Target
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe
-
Size
281KB
-
MD5
afe84c02cb0cf0a75a0b9a750e3f28d7
-
SHA1
ca9128481e8c8ecd7cc635522afa52f57e8f1763
-
SHA256
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74
-
SHA512
8106fed5800c343d35662913c657c7b3920100cfac0c3fe81554f5d325a98553614e7c7bb32efa9e761fa2c40de40ba561015557e7cab574b132b9b8561b2ed2
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@sectex.net
admin@sectex.world
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RemoveResolve.tiff 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe -
Drops startup file 5 IoCs
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe = "C:\\Windows\\System32\\39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe" 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exedescription ioc process File opened for modification C:\Program Files (x86)\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Music\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Videos\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Links\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Music\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VFDYFLB4\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8SF34HL\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Documents\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe -
Drops file in System32 directory 2 IoCs
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exedescription ioc process File created C:\Windows\System32\39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Windows\System32\Info.hta 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exedescription pid process target process PID 1840 set thread context of 1516 1840 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe -
Drops file in Program Files directory 64 IoCs
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185828.WMF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jre7\lib\calendars.properties.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Black Tie.thmx.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRM.XML.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeLetter.Dotx.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\THMBNAIL.PNG 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BZCRD98.POC.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBENDF98.CHM.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099201.GIF 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\Java\jre7\lib\ext\dnsns.jar.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\HEADINGBB.DPV 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSN.ICO.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\WWINTL.REST.IDX_DLL.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTVIEW.JPG 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105298.WMF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03464_.WMF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6B.GIF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFNOT.ICO.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL081.XML.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TWRECE.DLL.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\FLASH.NET.XML.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5A.BDR.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OLKIRM.XML.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jre7\bin\jli.dll.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\WriteUse.ADTS.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBPQT.DPV.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\TEAROFF.POC.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\COMPUTER.ICO 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090783.WMF.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif.id-D46C7B2B.[admin@sectex.net].bot 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 112 vssadmin.exe 668 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exepid process 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 380 vssvc.exe Token: SeRestorePrivilege 380 vssvc.exe Token: SeAuditPrivilege 380 vssvc.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.execmd.execmd.exedescription pid process target process PID 1840 wrote to memory of 1516 1840 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe PID 1840 wrote to memory of 1516 1840 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe PID 1840 wrote to memory of 1516 1840 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe PID 1840 wrote to memory of 1516 1840 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe PID 1840 wrote to memory of 1516 1840 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe PID 1516 wrote to memory of 936 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe cmd.exe PID 1516 wrote to memory of 936 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe cmd.exe PID 1516 wrote to memory of 936 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe cmd.exe PID 1516 wrote to memory of 936 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe cmd.exe PID 936 wrote to memory of 764 936 cmd.exe mode.com PID 936 wrote to memory of 764 936 cmd.exe mode.com PID 936 wrote to memory of 764 936 cmd.exe mode.com PID 936 wrote to memory of 112 936 cmd.exe vssadmin.exe PID 936 wrote to memory of 112 936 cmd.exe vssadmin.exe PID 936 wrote to memory of 112 936 cmd.exe vssadmin.exe PID 1516 wrote to memory of 1176 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe cmd.exe PID 1516 wrote to memory of 1176 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe cmd.exe PID 1516 wrote to memory of 1176 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe cmd.exe PID 1516 wrote to memory of 1176 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe cmd.exe PID 1176 wrote to memory of 1504 1176 cmd.exe mode.com PID 1176 wrote to memory of 1504 1176 cmd.exe mode.com PID 1176 wrote to memory of 1504 1176 cmd.exe mode.com PID 1176 wrote to memory of 668 1176 cmd.exe vssadmin.exe PID 1176 wrote to memory of 668 1176 cmd.exe vssadmin.exe PID 1176 wrote to memory of 668 1176 cmd.exe vssadmin.exe PID 1516 wrote to memory of 1664 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe mshta.exe PID 1516 wrote to memory of 1664 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe mshta.exe PID 1516 wrote to memory of 1664 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe mshta.exe PID 1516 wrote to memory of 1664 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe mshta.exe PID 1516 wrote to memory of 1524 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe mshta.exe PID 1516 wrote to memory of 1524 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe mshta.exe PID 1516 wrote to memory of 1524 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe mshta.exe PID 1516 wrote to memory of 1524 1516 39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe"C:\Users\Admin\AppData\Local\Temp\39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exeC:\Users\Admin\AppData\Local\Temp\39a93783c0b12ac161d029a229ac66363023e64491ca9aac95ce180ca3758c74.exe2⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
9c20e89c9905f00acda389c50c6e792e
SHA18082ff27a7779ec134d8d30115a7ca79109fbd95
SHA256b30abc41d324c5369cdd2cb3982a8136d5b8115dd9ad9143514b3e2438eab622
SHA512a94ce43be1f3a3616df7652f7fabc3f48f905127dd3a0f314452df3bdac266c951f6aa64baf0528d90d26b769b7957ae05bb1082e75cfee4b38a681e3abcbac5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
9c20e89c9905f00acda389c50c6e792e
SHA18082ff27a7779ec134d8d30115a7ca79109fbd95
SHA256b30abc41d324c5369cdd2cb3982a8136d5b8115dd9ad9143514b3e2438eab622
SHA512a94ce43be1f3a3616df7652f7fabc3f48f905127dd3a0f314452df3bdac266c951f6aa64baf0528d90d26b769b7957ae05bb1082e75cfee4b38a681e3abcbac5
-
memory/112-72-0x0000000000000000-mapping.dmp
-
memory/668-75-0x0000000000000000-mapping.dmp
-
memory/764-71-0x0000000000000000-mapping.dmp
-
memory/936-69-0x0000000000000000-mapping.dmp
-
memory/1176-73-0x0000000000000000-mapping.dmp
-
memory/1504-74-0x0000000000000000-mapping.dmp
-
memory/1516-67-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1516-66-0x000000000040A9D0-mapping.dmp
-
memory/1516-62-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1524-77-0x0000000000000000-mapping.dmp
-
memory/1664-76-0x0000000000000000-mapping.dmp
-
memory/1840-70-0x00000000004C0000-0x00000000004CC000-memory.dmpFilesize
48KB
-
memory/1840-60-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/1840-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB