Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
27-03-2022 21:26
Static task
static1
Behavioral task
behavioral1
Sample
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe
Resource
win10v2004-en-20220113
General
-
Target
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe
-
Size
332KB
-
MD5
cdeb26fdda31ec0b91549dd7066be08a
-
SHA1
b6015d8c1ecfaa862b6208e5b516e8369a167b49
-
SHA256
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0
-
SHA512
4f36908b1e90662312c7397cb86aac9c5a2270090573ae2e14069f31cd09f0a6b4de65fde472eca25e509997975753e6c9e9ce6f169d70a95d0b033d530f78cb
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
https://tox.chat/download.html
http://pexdatax.com/
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RequestUnpublish.tiff edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe -
Drops startup file 5 IoCs
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe = "C:\\Windows\\System32\\edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe" edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Videos\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Documents\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\Libraries\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\Pictures\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Searches\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\Downloads\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Music\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\Music\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\Videos\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Links\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\Desktop\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Users\Public\Documents\desktop.ini edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe -
Drops file in System32 directory 2 IoCs
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exedescription ioc process File created C:\Windows\System32\edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Windows\System32\Info.hta edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe -
Drops file in Program Files directory 64 IoCs
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg3.jpg edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder-default.svg.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\97.0.1072.55\Locales\en-GB.pak.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-unplated_contrast-white.png edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_92.0.902.67_neutral__8wekyb3d8bbwe\AppxSignature.p7x edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview.png.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lb.pak.DATA edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pl.jar.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40_altform-unplated.png edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_mmx_plugin.dll.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-200.png edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d6.png edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\vccorlib140.dll edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-80_altform-lightunplated.png edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\download.svg edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ui-strings.js.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\PREVIEW.GIF.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.scale-200.png edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ui-strings.js.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Cryptomining.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected].[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\PREVIEW.GIF edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Mozilla Firefox\firefox.exe.sig.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons2x.png.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_mr.dll.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\Xusage.txt edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-32.png edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ko-kr\ui-strings.js.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\organize.svg.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.id-DAB30B5C.[[email protected]].ROGER edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 4176 vssadmin.exe 2208 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exepid process 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4608 vssvc.exe Token: SeRestorePrivilege 4608 vssvc.exe Token: SeAuditPrivilege 4608 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.execmd.execmd.exedescription pid process target process PID 2920 wrote to memory of 4184 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe cmd.exe PID 2920 wrote to memory of 4184 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe cmd.exe PID 4184 wrote to memory of 4688 4184 cmd.exe mode.com PID 4184 wrote to memory of 4688 4184 cmd.exe mode.com PID 4184 wrote to memory of 4176 4184 cmd.exe vssadmin.exe PID 4184 wrote to memory of 4176 4184 cmd.exe vssadmin.exe PID 2920 wrote to memory of 1372 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe cmd.exe PID 2920 wrote to memory of 1372 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe cmd.exe PID 1372 wrote to memory of 3968 1372 cmd.exe mode.com PID 1372 wrote to memory of 3968 1372 cmd.exe mode.com PID 1372 wrote to memory of 2208 1372 cmd.exe vssadmin.exe PID 1372 wrote to memory of 2208 1372 cmd.exe vssadmin.exe PID 2920 wrote to memory of 2484 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe mshta.exe PID 2920 wrote to memory of 2484 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe mshta.exe PID 2920 wrote to memory of 4892 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe mshta.exe PID 2920 wrote to memory of 4892 2920 edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe"C:\Users\Admin\AppData\Local\Temp\edc04c29fc92b8a1ef8e47ed9935d54d4d8b93c3d7ab3893e8da749bcc418ac0.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:4688
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4176 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3968
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2208 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:2484
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:4892
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4608
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD554b2baf62811bcf2ce6afe78b2530fc5
SHA1309a051e19ba3121ddeaa63e4e52d075ecdb0a53
SHA25663684fcb8691c898a05feb3286a8a8471ea0e584af839a85eb02a12618790d9a
SHA512cba95a46db10d6b978e778c589ca3dc47e9dc9ed9d0fd195d02902ef00a511f5f8d6a3935717d611ea7c0bd1ebda5ab2d71289d9e5e34a1caf62f9e650d12470
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD554b2baf62811bcf2ce6afe78b2530fc5
SHA1309a051e19ba3121ddeaa63e4e52d075ecdb0a53
SHA25663684fcb8691c898a05feb3286a8a8471ea0e584af839a85eb02a12618790d9a
SHA512cba95a46db10d6b978e778c589ca3dc47e9dc9ed9d0fd195d02902ef00a511f5f8d6a3935717d611ea7c0bd1ebda5ab2d71289d9e5e34a1caf62f9e650d12470
-
memory/1372-139-0x0000000000000000-mapping.dmp
-
memory/2208-141-0x0000000000000000-mapping.dmp
-
memory/2484-142-0x0000000000000000-mapping.dmp
-
memory/2920-136-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/2920-135-0x0000000002240000-0x0000000002259000-memory.dmpFilesize
100KB
-
memory/2920-134-0x0000000002220000-0x0000000002232000-memory.dmpFilesize
72KB
-
memory/3968-140-0x0000000000000000-mapping.dmp
-
memory/4176-138-0x0000000000000000-mapping.dmp
-
memory/4184-133-0x0000000000000000-mapping.dmp
-
memory/4688-137-0x0000000000000000-mapping.dmp
-
memory/4892-143-0x0000000000000000-mapping.dmp