Analysis
-
max time kernel
4294211s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
26-03-2022 09:31
Static task
static1
Behavioral task
behavioral1
Sample
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe
Resource
win10v2004-en-20220113
General
-
Target
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe
-
Size
225KB
-
MD5
38d8196d6735ab2f722f5efa7a89deef
-
SHA1
98be4a8c94af03b163004198175068ae01f558d3
-
SHA256
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f
-
SHA512
8487675d8853dfcdad03240625655303a062e7e0c4122d19724caa4791ae8181ebeeb4a9e2bf0398039e081254acc94790b1e003070a79327559304ca7fb7dd3
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
https://tox.chat/download.html
http://pexdatax.com/
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RepairEdit.tiff 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Pictures\TestPing.tiff 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Drops startup file 5 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe = "C:\\Windows\\System32\\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe" 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X35V0ZKL\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Public\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9WQZNFH4\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\9Z3MD1WX\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YXYDN81Q\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Links\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6GA0X34V\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Music\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\318MUB20\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Drops file in System32 directory 2 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File created C:\Windows\System32\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Windows\System32\Info.hta 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\clock.html 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239191.WMF 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XML2WORD.XSL.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\drive.crx.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\CASCADE.ELM.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PPINTL.REST.IDX_DLL 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Training.potx.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15135_.GIF.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.DPV.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMIMES.CFG 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107264.WMF.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01777_.WMF 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0286034.WMF 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SplashScreen.bmp.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\Office64WW.XML.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jre7\bin\server\classes.jsa 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Java\jre7\bin\javaw.exe.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00779_.WMF.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwgl_plugin.dll 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0294991.WMF.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Windows Mail\fr-FR\msoeres.dll.mui 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_ON.GIF 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UCT 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183174.WMF 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01172_.WMF.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLIST.CFG.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEML.ICO.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-E4919DD3.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 944 vssadmin.exe 1540 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exepid process 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1468 vssvc.exe Token: SeRestorePrivilege 1468 vssvc.exe Token: SeAuditPrivilege 1468 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.execmd.execmd.exedescription pid process target process PID 1696 wrote to memory of 1624 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 1696 wrote to memory of 1624 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 1696 wrote to memory of 1624 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 1696 wrote to memory of 1624 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 1624 wrote to memory of 2000 1624 cmd.exe mode.com PID 1624 wrote to memory of 2000 1624 cmd.exe mode.com PID 1624 wrote to memory of 2000 1624 cmd.exe mode.com PID 1624 wrote to memory of 944 1624 cmd.exe vssadmin.exe PID 1624 wrote to memory of 944 1624 cmd.exe vssadmin.exe PID 1624 wrote to memory of 944 1624 cmd.exe vssadmin.exe PID 1696 wrote to memory of 1204 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 1696 wrote to memory of 1204 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 1696 wrote to memory of 1204 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 1696 wrote to memory of 1204 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 1204 wrote to memory of 1844 1204 cmd.exe mode.com PID 1204 wrote to memory of 1844 1204 cmd.exe mode.com PID 1204 wrote to memory of 1844 1204 cmd.exe mode.com PID 1204 wrote to memory of 1540 1204 cmd.exe vssadmin.exe PID 1204 wrote to memory of 1540 1204 cmd.exe vssadmin.exe PID 1204 wrote to memory of 1540 1204 cmd.exe vssadmin.exe PID 1696 wrote to memory of 1836 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe mshta.exe PID 1696 wrote to memory of 1836 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe mshta.exe PID 1696 wrote to memory of 1836 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe mshta.exe PID 1696 wrote to memory of 1836 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe mshta.exe PID 1696 wrote to memory of 204 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe mshta.exe PID 1696 wrote to memory of 204 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe mshta.exe PID 1696 wrote to memory of 204 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe mshta.exe PID 1696 wrote to memory of 204 1696 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe"C:\Users\Admin\AppData\Local\Temp\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2000
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:944 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1844
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1540 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:1836 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:204
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD547eb54bcefcae200858637f7b6c383c8
SHA1eea7a42e04666095b7a2be2c80f7304e84949a4d
SHA256639231790cfe66e23238007519dd16d7bf7218c5384789a5d7e9970afaa22b7f
SHA512596aceb225aa3ea1aec587e302a2fb0f71b80526a587688c27a542132719f68aa041cf1c5e746e06ba3c814d04cfad5e784a6cabba52c59e6f43db058723f8d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD547eb54bcefcae200858637f7b6c383c8
SHA1eea7a42e04666095b7a2be2c80f7304e84949a4d
SHA256639231790cfe66e23238007519dd16d7bf7218c5384789a5d7e9970afaa22b7f
SHA512596aceb225aa3ea1aec587e302a2fb0f71b80526a587688c27a542132719f68aa041cf1c5e746e06ba3c814d04cfad5e784a6cabba52c59e6f43db058723f8d1
-
memory/204-66-0x0000000000000000-mapping.dmp
-
memory/944-60-0x0000000000000000-mapping.dmp
-
memory/1204-62-0x0000000000000000-mapping.dmp
-
memory/1540-64-0x0000000000000000-mapping.dmp
-
memory/1624-56-0x0000000000000000-mapping.dmp
-
memory/1696-58-0x000000000030B000-0x000000000031E000-memory.dmpFilesize
76KB
-
memory/1696-59-0x00000000001B0000-0x00000000001C9000-memory.dmpFilesize
100KB
-
memory/1696-61-0x0000000000400000-0x00000000008D7000-memory.dmpFilesize
4.8MB
-
memory/1696-54-0x000000000030B000-0x000000000031E000-memory.dmpFilesize
76KB
-
memory/1696-55-0x0000000075421000-0x0000000075423000-memory.dmpFilesize
8KB
-
memory/1836-65-0x0000000000000000-mapping.dmp
-
memory/1844-63-0x0000000000000000-mapping.dmp
-
memory/2000-57-0x0000000000000000-mapping.dmp