Analysis
-
max time kernel
4294213s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
30-03-2022 01:14
Static task
static1
Behavioral task
behavioral1
Sample
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe
Resource
win10v2004-en-20220113
General
-
Target
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe
-
Size
492KB
-
MD5
cf33054b5e1551583945bc1960af2864
-
SHA1
27888d41034f43ae52f17d15896f6a919e37ade0
-
SHA256
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31
-
SHA512
a92fbcbe9494dd055f43bc468ec8826f26147a185f46996240ac68b48f663adbb74007a5170af9cb7b5151b7b3df6d1d8e822323bba6dc3f565be4008f0fec68
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe = "C:\\Windows\\System32\\80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe" 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe -
Drops desktop.ini file(s) 13 IoCs
Processes:
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2199625441-3471261906-229485034-1000\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\desktop.ini 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe -
Drops file in System32 directory 1 IoCs
Processes:
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exedescription ioc process File created C:\Windows\System32\80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe -
Drops file in Program Files directory 64 IoCs
Processes:
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0251007.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01236_.WMF 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01638_.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0150861.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNoteSyncPC.dll 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\d3dcompiler_47.dll.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MUAUTH.CAB.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewSelectionChanged.js.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187835.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0294989.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\libEGL.dll.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107130.WMF 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199307.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files\7-Zip\Lang\ro.txt.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Java\jre7\bin\dt_socket.dll 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187883.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POSTIT.CFG 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15185_.GIF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_nl.dll 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8B.GIF 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUDIOSEARCHSAPIFE.DLL.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.0.2.jar.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03513_.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18210_.WMF 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MAPIR.DLL.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384862.JPG.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01239_.GIF.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pidgenx.dll.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21344_.GIF 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0294989.WMF 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0337280.JPG 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.id-BBAD6D77.[[email protected]].ROGER 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 436 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exepid process 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1288 vssvc.exe Token: SeRestorePrivilege 1288 vssvc.exe Token: SeAuditPrivilege 1288 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.execmd.exedescription pid process target process PID 1860 wrote to memory of 1952 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe cmd.exe PID 1860 wrote to memory of 1952 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe cmd.exe PID 1860 wrote to memory of 1952 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe cmd.exe PID 1860 wrote to memory of 1952 1860 80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe cmd.exe PID 1952 wrote to memory of 1804 1952 cmd.exe mode.com PID 1952 wrote to memory of 1804 1952 cmd.exe mode.com PID 1952 wrote to memory of 1804 1952 cmd.exe mode.com PID 1952 wrote to memory of 436 1952 cmd.exe vssadmin.exe PID 1952 wrote to memory of 436 1952 cmd.exe vssadmin.exe PID 1952 wrote to memory of 436 1952 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe"C:\Users\Admin\AppData\Local\Temp\80130935101adaabe9e85bb9d3aa21a195bf041b8d71989773cfe9f442868a31.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1804
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:436
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1288
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/436-59-0x0000000000000000-mapping.dmp
-
memory/1804-57-0x0000000000000000-mapping.dmp
-
memory/1860-54-0x0000000075E61000-0x0000000075E63000-memory.dmpFilesize
8KB
-
memory/1860-55-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1860-58-0x0000000002000000-0x0000000002590000-memory.dmpFilesize
5.6MB
-
memory/1952-56-0x0000000000000000-mapping.dmp