Analysis
-
max time kernel
150s -
max time network
172s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
10-06-2021 11:02
Static task
static1
Behavioral task
behavioral1
Sample
1c_bitrix.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1c_bitrix.exe
Resource
win10v20210410
General
-
Target
1c_bitrix.exe
-
Size
92KB
-
MD5
80b21955369b73d9c3b73214905c8ba7
-
SHA1
c3b6c20dd9f7d9b3246683952db3b1800e19664e
-
SHA256
1af26c9d78b02d5b43e43029645046aa2544cf43f9cf068cb6188b5261db25bb
-
SHA512
f3a5c5c496e552c0f8853b45ce06f451187cc2d73a1eea242bbd9d641245f79a6ddc08eae7b35ef14ad94a2b575d5facb05a4e8867391cd2df3728c4b41c69c7
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
xcsset@criptext.com
xcsset@aol.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
1c_bitrix.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1c_bitrix.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 1c_bitrix.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c_bitrix.exe 1c_bitrix.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
1c_bitrix.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 1c_bitrix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 1c_bitrix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1c_bitrix.exe = "C:\\Windows\\System32\\1c_bitrix.exe" 1c_bitrix.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
1c_bitrix.exedescription ioc process File opened for modification C:\Users\Admin\Searches\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XVLP3GFJ\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\93PHUZFG\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2MTLR0RV\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1c_bitrix.exe File opened for modification C:\Program Files\desktop.ini 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1c_bitrix.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQE06QBJ\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Music\desktop.ini 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SLC8MVWU\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1c_bitrix.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AJ1NIV9I\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1c_bitrix.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1c_bitrix.exe -
Drops file in System32 directory 2 IoCs
Processes:
1c_bitrix.exedescription ioc process File created C:\Windows\System32\1c_bitrix.exe 1c_bitrix.exe File created C:\Windows\System32\Info.hta 1c_bitrix.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1c_bitrix.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0202045.JPG.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Curacao.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02448_.WMF 1c_bitrix.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04174_.WMF 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF 1c_bitrix.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\gadget.xml 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02276_.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CT_ROOTS.XML.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 1c_bitrix.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate.css.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXEV.DLL 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm 1c_bitrix.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195772.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01473_.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02228_.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files\7-Zip\History.txt.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar 1c_bitrix.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XLSLICER.DLL.IDX_DLL 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\WIND.WAV 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\validation.js 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\UmOutlookStrings.dll.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF 1c_bitrix.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_hail.png 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152898.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18229_.WMF 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\JPEGIM32.FLT 1c_bitrix.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199307.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212957.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar 1c_bitrix.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233018.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251301.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02361_.WMF.id-3B2F29E5.[xcsset@criptext.com].xcss 1c_bitrix.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar 1c_bitrix.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 300 vssadmin.exe 2024 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1c_bitrix.exepid process 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe 1156 1c_bitrix.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1008 vssvc.exe Token: SeRestorePrivilege 1008 vssvc.exe Token: SeAuditPrivilege 1008 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
1c_bitrix.execmd.execmd.exedescription pid process target process PID 1156 wrote to memory of 1688 1156 1c_bitrix.exe cmd.exe PID 1156 wrote to memory of 1688 1156 1c_bitrix.exe cmd.exe PID 1156 wrote to memory of 1688 1156 1c_bitrix.exe cmd.exe PID 1156 wrote to memory of 1688 1156 1c_bitrix.exe cmd.exe PID 1688 wrote to memory of 1272 1688 cmd.exe mode.com PID 1688 wrote to memory of 1272 1688 cmd.exe mode.com PID 1688 wrote to memory of 1272 1688 cmd.exe mode.com PID 1688 wrote to memory of 300 1688 cmd.exe vssadmin.exe PID 1688 wrote to memory of 300 1688 cmd.exe vssadmin.exe PID 1688 wrote to memory of 300 1688 cmd.exe vssadmin.exe PID 1156 wrote to memory of 876 1156 1c_bitrix.exe cmd.exe PID 1156 wrote to memory of 876 1156 1c_bitrix.exe cmd.exe PID 1156 wrote to memory of 876 1156 1c_bitrix.exe cmd.exe PID 1156 wrote to memory of 876 1156 1c_bitrix.exe cmd.exe PID 876 wrote to memory of 1280 876 cmd.exe mode.com PID 876 wrote to memory of 1280 876 cmd.exe mode.com PID 876 wrote to memory of 1280 876 cmd.exe mode.com PID 1156 wrote to memory of 1544 1156 1c_bitrix.exe mshta.exe PID 1156 wrote to memory of 1544 1156 1c_bitrix.exe mshta.exe PID 1156 wrote to memory of 1544 1156 1c_bitrix.exe mshta.exe PID 1156 wrote to memory of 1544 1156 1c_bitrix.exe mshta.exe PID 876 wrote to memory of 2024 876 cmd.exe vssadmin.exe PID 876 wrote to memory of 2024 876 cmd.exe vssadmin.exe PID 876 wrote to memory of 2024 876 cmd.exe vssadmin.exe PID 1156 wrote to memory of 960 1156 1c_bitrix.exe mshta.exe PID 1156 wrote to memory of 960 1156 1c_bitrix.exe mshta.exe PID 1156 wrote to memory of 960 1156 1c_bitrix.exe mshta.exe PID 1156 wrote to memory of 960 1156 1c_bitrix.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c_bitrix.exe"C:\Users\Admin\AppData\Local\Temp\1c_bitrix.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
ecfde72bec84eaaee00c31e310f7967b
SHA1acb20a951681677162d645e97addd44373469128
SHA2567d24b6d7035a026b2b643abf70ad5e06387574cfe952fc9740bf911bc489e4ed
SHA512b13c0bd318f09989f0f857efb425f7a472f981a644339a0e78609c7bc87008bb4bbe8b239260a2b225c58a7c3115febd23d55e71a5514f832401c78dbef041d4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
ecfde72bec84eaaee00c31e310f7967b
SHA1acb20a951681677162d645e97addd44373469128
SHA2567d24b6d7035a026b2b643abf70ad5e06387574cfe952fc9740bf911bc489e4ed
SHA512b13c0bd318f09989f0f857efb425f7a472f981a644339a0e78609c7bc87008bb4bbe8b239260a2b225c58a7c3115febd23d55e71a5514f832401c78dbef041d4
-
memory/300-63-0x0000000000000000-mapping.dmp
-
memory/876-64-0x0000000000000000-mapping.dmp
-
memory/960-68-0x0000000000000000-mapping.dmp
-
memory/1156-60-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1272-62-0x0000000000000000-mapping.dmp
-
memory/1280-65-0x0000000000000000-mapping.dmp
-
memory/1544-66-0x0000000000000000-mapping.dmp
-
memory/1688-61-0x0000000000000000-mapping.dmp
-
memory/2024-67-0x0000000000000000-mapping.dmp