Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
06-03-2022 02:08
Static task
static1
Behavioral task
behavioral1
Sample
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe
Resource
win10v2004-en-20220113
General
-
Target
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe
-
Size
92KB
-
MD5
9bd01243bd68f7a4fd38430d59aa7fdd
-
SHA1
ccb27b96fe783b9eaf66d6f359be0ccfeb33470e
-
SHA256
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb
-
SHA512
04b6cd2e15490f743456ad643ba2a3d5ba3ce9eeee7dc0fd6ef81bdb74695798bf9a73523db192f824d1fcbc5cad105b3a00f98b1e4cab7f8113a1c34edf9e28
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe -
Drops startup file 5 IoCs
Processes:
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe = "C:\\Windows\\System32\\d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe" d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Links\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Music\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Public\Desktop\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Public\Music\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Public\Videos\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Documents\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Public\Documents\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe -
Drops file in System32 directory 2 IoCs
Processes:
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exedescription ioc process File created C:\Windows\System32\d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Windows\System32\Info.hta d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql120.xsl d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\amd64\jvm.cfg d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-400.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\styles\WefGalleryOnenote.css d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-400.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\MSFT_PackageManagementSource.schema.mfl.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\extensibility.dll.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\invalid32x32.gif.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\PREVIEW.GIF d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-200_contrast-white.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-200.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\caution.svg.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pt_BR.jar d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-200_contrast-white.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointPortalSite.ico.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check.cur d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\ui-strings.js.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\vcruntime140.dll.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.55\msedgeupdateres_cy.dll.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotBeNullOrEmpty.snippets.ps1xml d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-125_contrast-white.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\inktotextengineimm.dll d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main-selector.css.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-black_scale-125.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\PlayStore_icon.svg.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\plugin.js.id-AB2D1742.[[email protected]].harma d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.AppContext.dll d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 3976 vssadmin.exe 4076 vssadmin.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exepid process 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4040 vssvc.exe Token: SeRestorePrivilege 4040 vssvc.exe Token: SeAuditPrivilege 4040 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.execmd.execmd.exedescription pid process target process PID 2432 wrote to memory of 2640 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe cmd.exe PID 2432 wrote to memory of 2640 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe cmd.exe PID 2640 wrote to memory of 4128 2640 cmd.exe mode.com PID 2640 wrote to memory of 4128 2640 cmd.exe mode.com PID 2640 wrote to memory of 3976 2640 cmd.exe vssadmin.exe PID 2640 wrote to memory of 3976 2640 cmd.exe vssadmin.exe PID 2432 wrote to memory of 4260 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe cmd.exe PID 2432 wrote to memory of 4260 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe cmd.exe PID 4260 wrote to memory of 3432 4260 cmd.exe mode.com PID 4260 wrote to memory of 3432 4260 cmd.exe mode.com PID 4260 wrote to memory of 4076 4260 cmd.exe vssadmin.exe PID 4260 wrote to memory of 4076 4260 cmd.exe vssadmin.exe PID 2432 wrote to memory of 4688 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe mshta.exe PID 2432 wrote to memory of 4688 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe mshta.exe PID 2432 wrote to memory of 3728 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe mshta.exe PID 2432 wrote to memory of 3728 2432 d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe"C:\Users\Admin\AppData\Local\Temp\d619b390215004685475031a41a63e00464812888ba29718b345ad4fd23766cb.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:4128
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3976 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3432
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4076 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:4688
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:3728
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:316
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
bd5dd1654b80ece7414560d4e21b0a2e
SHA1299df4370a59b9a2798d80b18c0e649f426dc5b1
SHA2564cc277222869f671ee9874e8f629a0eeec6f76781db7bfb322a584fd7e1e77e7
SHA51228227d9922c329a2457043678f1b6aa414769476cac62a7f11807d73200b1ac04f6df003d3eb08f0a1d8c8a5f09b8c74606b15765b87e98181636bdfb2d7003b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
bd5dd1654b80ece7414560d4e21b0a2e
SHA1299df4370a59b9a2798d80b18c0e649f426dc5b1
SHA2564cc277222869f671ee9874e8f629a0eeec6f76781db7bfb322a584fd7e1e77e7
SHA51228227d9922c329a2457043678f1b6aa414769476cac62a7f11807d73200b1ac04f6df003d3eb08f0a1d8c8a5f09b8c74606b15765b87e98181636bdfb2d7003b
-
memory/316-131-0x000001FCACA20000-0x000001FCACA30000-memory.dmpFilesize
64KB
-
memory/316-130-0x000001FCABF60000-0x000001FCABF70000-memory.dmpFilesize
64KB
-
memory/316-132-0x000001FCACBE0000-0x000001FCACBE4000-memory.dmpFilesize
16KB