Analysis
-
max time kernel
4294251s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
15-03-2022 19:21
Behavioral task
behavioral1
Sample
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe
Resource
win10v2004-en-20220113
General
-
Target
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe
-
Size
575KB
-
MD5
28527433b0bd73c50a6a6921e1053124
-
SHA1
7a89b07d4e695a4745ad6732e5a4a14eeba85cff
-
SHA256
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713
-
SHA512
f5b2a51c9271dd42aa52c68d77c9558cc02241ef6a022dbd56ed28dd08e801733ec50917424fd4c8568553508f4e1abfa0dcc1032d9e424c4bab589950253d66
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe = "C:\\Windows\\System32\\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe" 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Drops desktop.ini file(s) 13 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2199625441-3471261906-229485034-1000\desktop.ini 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Drops file in System32 directory 1 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process File created C:\Windows\System32\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\clock.css 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101865.BMP.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\System\ado\msado25.tlb 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02158_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jre7\bin\nio.dll.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\EnterRename.ppt.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00308_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105250.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387578.JPG 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files\7-Zip\Uninstall.exe.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152556.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18190_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01474_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected].[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBLR6.CHM.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105320.WMF 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287018.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00603_.WMF.id-273DC8DE.[[email protected]].ROGER 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1952 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exepid process 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1496 vssvc.exe Token: SeRestorePrivilege 1496 vssvc.exe Token: SeAuditPrivilege 1496 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.execmd.exedescription pid process target process PID 1100 wrote to memory of 316 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe cmd.exe PID 1100 wrote to memory of 316 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe cmd.exe PID 1100 wrote to memory of 316 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe cmd.exe PID 1100 wrote to memory of 316 1100 1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe cmd.exe PID 316 wrote to memory of 1964 316 cmd.exe mode.com PID 316 wrote to memory of 1964 316 cmd.exe mode.com PID 316 wrote to memory of 1964 316 cmd.exe mode.com PID 316 wrote to memory of 1952 316 cmd.exe vssadmin.exe PID 316 wrote to memory of 1952 316 cmd.exe vssadmin.exe PID 316 wrote to memory of 1952 316 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe"C:\Users\Admin\AppData\Local\Temp\1d6463170b7e71234a1fe0ddde27dff4285c45a8b11b57061c78639092154713.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken