Analysis
-
max time kernel
155s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 09:31
Static task
static1
Behavioral task
behavioral1
Sample
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe
Resource
win10v2004-en-20220113
General
-
Target
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe
-
Size
225KB
-
MD5
38d8196d6735ab2f722f5efa7a89deef
-
SHA1
98be4a8c94af03b163004198175068ae01f558d3
-
SHA256
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f
-
SHA512
8487675d8853dfcdad03240625655303a062e7e0c4122d19724caa4791ae8181ebeeb4a9e2bf0398039e081254acc94790b1e003070a79327559304ca7fb7dd3
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 4 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe = "C:\\Windows\\System32\\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe" 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Drops desktop.ini file(s) 44 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Links\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Music\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Drops file in System32 directory 1 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File created C:\Windows\System32\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_18.svg.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hu-hu\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\flavormap.properties.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-100_contrast-white.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sv-se\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-150.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnvpxy.cnv.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\close.svg.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\DisconnectCompress.rar.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-200.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected].[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-300.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\SmallTile.scale-200_contrast-black.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-stdio-l1-1-0.dll 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-stdio-l1-1-0.dll 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-200.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\fillandsign.svg.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen.svg.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinClassNotebook.xml 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-125.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\plugin.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\ui-strings.js 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\WATER.INF.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\PREVIEW.GIF 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Preview.scale-200_layoutdir-RTL.png 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfxswt.jar.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kk-KZ\View3d\3DViewerProductDescription-universal.xml 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\ui-strings.js.id-5D50AFF8.[[email protected]].ROGER 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-actions.xml 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2iexp.dll 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4468 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exepid process 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 432 vssvc.exe Token: SeRestorePrivilege 432 vssvc.exe Token: SeAuditPrivilege 432 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.execmd.exedescription pid process target process PID 2016 wrote to memory of 2308 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 2016 wrote to memory of 2308 2016 9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe cmd.exe PID 2308 wrote to memory of 5000 2308 cmd.exe mode.com PID 2308 wrote to memory of 5000 2308 cmd.exe mode.com PID 2308 wrote to memory of 4468 2308 cmd.exe vssadmin.exe PID 2308 wrote to memory of 4468 2308 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe"C:\Users\Admin\AppData\Local\Temp\9b8ee39266f5e131f05768ed561f7dd4bed27df903fe71a276ad5a22af980f1f.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:5000
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4468
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2016-130-0x0000000000B68000-0x0000000000B7B000-memory.dmpFilesize
76KB
-
memory/2016-131-0x0000000000B68000-0x0000000000B7B000-memory.dmpFilesize
76KB
-
memory/2016-134-0x0000000000A20000-0x0000000000A39000-memory.dmpFilesize
100KB
-
memory/2016-135-0x0000000000400000-0x00000000008D7000-memory.dmpFilesize
4.8MB
-
memory/2308-132-0x0000000000000000-mapping.dmp
-
memory/4468-136-0x0000000000000000-mapping.dmp
-
memory/5000-133-0x0000000000000000-mapping.dmp