Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
05-03-2022 23:46
Static task
static1
Behavioral task
behavioral1
Sample
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe
Resource
win10v2004-en-20220113
General
-
Target
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe
-
Size
92KB
-
MD5
8d238d21851718af2c0615332560422a
-
SHA1
dd99f210b4bf89b7a5c26e7013488b84c1e1c220
-
SHA256
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44
-
SHA512
8446d8a1669c0ed0359effb33cfe29e59560201aed39f879f0ff70615ff6dc83232885b71a5307e63ca31245128ab41666b6fb66fedf654393efa71cdb2ff045
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe -
Drops startup file 5 IoCs
Processes:
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe = "C:\\Windows\\System32\\4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe" 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\Videos\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Links\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\Documents\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\Music\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Public\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Music\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe -
Drops file in System32 directory 2 IoCs
Processes:
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exedescription ioc process File created C:\Windows\System32\4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Windows\System32\Info.hta 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe -
Drops file in Program Files directory 64 IoCs
Processes:
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_18.svg.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.SPClient.Interfaces.dll.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200_contrast-high.png 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ja.pak.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\rename.svg.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main-selector.css.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSGet.Resource.psd1.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\View3d\3DViewerProductDescription-universal.xml 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ui-strings.js.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_zh_cn_135x40.svg 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugin.js.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\ui-strings.js.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-stdio-l1-1-0.dll.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Entities.DATA.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ms-logo-no-text.png 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_audit_report_18.svg.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons.png 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\concrt140.dll.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.InteropServices.WindowsRuntime.dll 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_contrast-white.png 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\access-bridge-64.jar.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-gb\ui-strings.js 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-48_altform-unplated.png 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\ui-strings.js.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.55\msedgeupdateres_az.dll 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File created C:\Program Files\7-Zip\Lang\th.txt.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\logo_retina.png 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.id-7847018F.[[email protected]].ROGER 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2020 vssadmin.exe 4056 vssadmin.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exepid process 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2160 vssvc.exe Token: SeRestorePrivilege 2160 vssvc.exe Token: SeAuditPrivilege 2160 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.execmd.execmd.exedescription pid process target process PID 600 wrote to memory of 848 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe cmd.exe PID 600 wrote to memory of 848 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe cmd.exe PID 848 wrote to memory of 1852 848 cmd.exe mode.com PID 848 wrote to memory of 1852 848 cmd.exe mode.com PID 848 wrote to memory of 2020 848 cmd.exe vssadmin.exe PID 848 wrote to memory of 2020 848 cmd.exe vssadmin.exe PID 600 wrote to memory of 2432 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe cmd.exe PID 600 wrote to memory of 2432 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe cmd.exe PID 2432 wrote to memory of 356 2432 cmd.exe mode.com PID 2432 wrote to memory of 356 2432 cmd.exe mode.com PID 2432 wrote to memory of 4056 2432 cmd.exe vssadmin.exe PID 2432 wrote to memory of 4056 2432 cmd.exe vssadmin.exe PID 600 wrote to memory of 4508 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe mshta.exe PID 600 wrote to memory of 4508 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe mshta.exe PID 600 wrote to memory of 788 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe mshta.exe PID 600 wrote to memory of 788 600 4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe"C:\Users\Admin\AppData\Local\Temp\4575d2fa721acf50f2c5cb9c89933bb9bfed9014ea04b3d3dc5bdfa858496b44.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1852
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2020 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:356
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4056 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:4508
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:788
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:5092
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
74ec698353adfa94f84f26821bd6fb19
SHA1a01dfa9aa64bd374e47e77471c192495451a92e1
SHA256178c9f9dce89a1138e5d5d35dc8679e8f4f7d9bfc2165913942c5df948443176
SHA51224882955e8c8c0234422967260ceec039e4dfcc4bff33ba25f8da21cc4e731c3bda5d245a9b8ec3a4bc00f0c9f00a46822bde7a626028adcf3e9246b9872aa34
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
74ec698353adfa94f84f26821bd6fb19
SHA1a01dfa9aa64bd374e47e77471c192495451a92e1
SHA256178c9f9dce89a1138e5d5d35dc8679e8f4f7d9bfc2165913942c5df948443176
SHA51224882955e8c8c0234422967260ceec039e4dfcc4bff33ba25f8da21cc4e731c3bda5d245a9b8ec3a4bc00f0c9f00a46822bde7a626028adcf3e9246b9872aa34
-
memory/5092-130-0x000001A901C90000-0x000001A901CA0000-memory.dmpFilesize
64KB
-
memory/5092-131-0x000001A901EC0000-0x000001A901ED0000-memory.dmpFilesize
64KB
-
memory/5092-132-0x000001A9042B0000-0x000001A9042B4000-memory.dmpFilesize
16KB