Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
05-03-2022 17:23
Static task
static1
Behavioral task
behavioral1
Sample
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe
Resource
win10v2004-en-20220113
General
-
Target
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe
-
Size
92KB
-
MD5
ca544a12a971b8251ae847f80cdbfabb
-
SHA1
6b9cd05633621ec9cafaed053cdd80cfc5ca41ee
-
SHA256
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff
-
SHA512
6276bdf588e452dcfc919adeb7d240d8451fe92d2a808b81eac929b1292ef43d557291a518a5f65c2856eec016256181d8ab79ba3ab0cb716d6fd9428d0b05d8
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\EnterCheckpoint.tiff 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Pictures\InstallDismount.tiff 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Pictures\RedoMove.tiff 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe -
Drops startup file 5 IoCs
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe = "C:\\Windows\\System32\\6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe" 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Public\Music\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Public\Videos\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Public\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Links\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Music\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe -
Drops file in System32 directory 2 IoCs
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exedescription ioc process File created C:\Windows\System32\6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Windows\System32\Info.hta 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe -
Drops file in Program Files directory 64 IoCs
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-48_altform-lightunplated.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MicrosoftLogo.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected].[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FBIBLIO.DLL 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\ui-strings.js.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-200.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\LargeTile.scale-200.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\EEINTL.DLL 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_empty_state.svg.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-selector.js.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\SmallLogoDev.png.DATA.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\ui-strings.js.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected].[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1851_20x20x32.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-200.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\StepGet.mpeg2.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle.cur.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\PREVIEW.GIF 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi\ui-strings.js 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-40_altform-lightunplated.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreWideTile.scale-200.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\Microsoft.PowerShell.PackageManagement.resources.dll 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-125.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-100_contrast-black.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACETXT.DLL.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ro.pak 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.id-36B86405.[[email protected]].harma 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 408 vssadmin.exe 3088 vssadmin.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exepid process 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4548 vssvc.exe Token: SeRestorePrivilege 4548 vssvc.exe Token: SeAuditPrivilege 4548 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.execmd.execmd.exedescription pid process target process PID 3808 wrote to memory of 4880 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe cmd.exe PID 3808 wrote to memory of 4880 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe cmd.exe PID 4880 wrote to memory of 1332 4880 cmd.exe mode.com PID 4880 wrote to memory of 1332 4880 cmd.exe mode.com PID 4880 wrote to memory of 408 4880 cmd.exe vssadmin.exe PID 4880 wrote to memory of 408 4880 cmd.exe vssadmin.exe PID 3808 wrote to memory of 4112 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe cmd.exe PID 3808 wrote to memory of 4112 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe cmd.exe PID 4112 wrote to memory of 964 4112 cmd.exe mode.com PID 4112 wrote to memory of 964 4112 cmd.exe mode.com PID 4112 wrote to memory of 3088 4112 cmd.exe vssadmin.exe PID 4112 wrote to memory of 3088 4112 cmd.exe vssadmin.exe PID 3808 wrote to memory of 1988 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe mshta.exe PID 3808 wrote to memory of 1988 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe mshta.exe PID 3808 wrote to memory of 1888 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe mshta.exe PID 3808 wrote to memory of 1888 3808 6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe"C:\Users\Admin\AppData\Local\Temp\6b99139d51f3413a035a0f158c68db3eaba474659bacce952560dbb1cc3bb7ff.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1332
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:408 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:964
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3088 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:1988
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:1888
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:1528
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
ad7e068d4f6231b52d12d760cd28e583
SHA1ba6dd064c60a99f1a582665256c1b40081252ebc
SHA2565f072a4dbba787c62854eae18d34ddfed570e9666782503ed56a867d380b3c37
SHA5120558870a4d541ef18224285ce36be3fdcd5e625d2c5f1fe487dedc95c0a1e5f115f2f076473091499aeb0674daa211c171c32dd4da294bd882cd7ffdd623ba25
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
ad7e068d4f6231b52d12d760cd28e583
SHA1ba6dd064c60a99f1a582665256c1b40081252ebc
SHA2565f072a4dbba787c62854eae18d34ddfed570e9666782503ed56a867d380b3c37
SHA5120558870a4d541ef18224285ce36be3fdcd5e625d2c5f1fe487dedc95c0a1e5f115f2f076473091499aeb0674daa211c171c32dd4da294bd882cd7ffdd623ba25
-
memory/1528-134-0x000002A24ED60000-0x000002A24ED70000-memory.dmpFilesize
64KB
-
memory/1528-135-0x000002A24EDC0000-0x000002A24EDD0000-memory.dmpFilesize
64KB
-
memory/1528-136-0x000002A251280000-0x000002A251281000-memory.dmpFilesize
4KB
-
memory/1528-137-0x000002A251280000-0x000002A251281000-memory.dmpFilesize
4KB
-
memory/1528-138-0x000002A251350000-0x000002A251354000-memory.dmpFilesize
16KB