Analysis
-
max time kernel
4294224s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
25-03-2022 06:52
Static task
static1
Behavioral task
behavioral1
Sample
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe
Resource
win10v2004-20220310-en
General
-
Target
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe
-
Size
341KB
-
MD5
d991b38f6102454e3148d402ddde6497
-
SHA1
a316dfc04d167b003c61d21e577ba79324138c19
-
SHA256
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0
-
SHA512
baa8d57919f8ef7eaf26f00dc1ce0acf13fc55ab6750488e2dfbcd59e89dd5b0b63582f9ff5e06a14226f5e753cf84af7d4f87cac768204ddae03626877bb9b2
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\MoveUnlock.tiff add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe -
Drops startup file 4 IoCs
Processes:
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe = "C:\\Windows\\System32\\add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe" add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\DL4J84XN\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XIWRAWIU\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Videos\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Desktop\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Music\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Videos\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Pictures\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Documents\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Downloads\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GMEWETP4\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JV18Q8B8\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VCDJSRLN\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5ZSPI9ZZ\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZVKSVSRO\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Documents\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Searches\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2199625441-3471261906-229485034-1000\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe -
Drops file in System32 directory 1 IoCs
Processes:
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exedescription ioc process File created C:\Windows\System32\add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe -
Drops file in Program Files directory 64 IoCs
Processes:
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0294989.WMF add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14828_.GIF.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_ON.GIF.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237336.WMF add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTES.ICO.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jre7\lib\zi\America\La_Paz.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\MAIL.ICO.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD.DPV add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\QuizShow.potx add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174315.WMF.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jre7\lib\psfontj2d.properties.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03143I.JPG.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImages.bmp add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01394_.WMF.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OCRVC.DAT add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jre7\bin\npt.dll.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jre7\lib\ext\localedata.jar.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9F.GIF add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00076_.WMF add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICSTYLES.DPV.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\settings.js add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.INF.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_COL.HXT add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKREQL.ICO add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21535_.GIF add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe File created C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSWDS_EN.LEX.id-B2E57288.[[email protected]].ROGER add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 428 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exepid process 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1276 vssvc.exe Token: SeRestorePrivilege 1276 vssvc.exe Token: SeAuditPrivilege 1276 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.execmd.exedescription pid process target process PID 1980 wrote to memory of 592 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe cmd.exe PID 1980 wrote to memory of 592 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe cmd.exe PID 1980 wrote to memory of 592 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe cmd.exe PID 1980 wrote to memory of 592 1980 add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe cmd.exe PID 592 wrote to memory of 2012 592 cmd.exe mode.com PID 592 wrote to memory of 2012 592 cmd.exe mode.com PID 592 wrote to memory of 2012 592 cmd.exe mode.com PID 592 wrote to memory of 428 592 cmd.exe vssadmin.exe PID 592 wrote to memory of 428 592 cmd.exe vssadmin.exe PID 592 wrote to memory of 428 592 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe"C:\Users\Admin\AppData\Local\Temp\add93ff66529e153263c05c8a01ea9b433788b861a2a5eb3def7bd538eb143e0.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2012
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:428
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/428-59-0x0000000000000000-mapping.dmp
-
memory/592-57-0x0000000000000000-mapping.dmp
-
memory/1980-54-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/1980-55-0x0000000000250000-0x0000000000269000-memory.dmpFilesize
100KB
-
memory/1980-56-0x0000000074C61000-0x0000000074C63000-memory.dmpFilesize
8KB
-
memory/1980-60-0x0000000000400000-0x00000000046D4000-memory.dmpFilesize
66.8MB
-
memory/2012-58-0x0000000000000000-mapping.dmp