Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
30-03-2022 09:11
Static task
static1
Behavioral task
behavioral1
Sample
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe
Resource
win10v2004-20220310-en
General
-
Target
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe
-
Size
335KB
-
MD5
00a35c46fb497c63ddad0b39f1a1c809
-
SHA1
43b529ed3dbf4f63413a28b129946f69821ca3bd
-
SHA256
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479
-
SHA512
07481326adee08d4c237c9ba133a106a7422ce4d6ff044e710634ce2b227e387428b96d4d1c859aa354fa1664c951e9cae9361f5e032d6d2af3537cf65a66f6b
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
https://tox.chat/download.html
http://pexdatax.com/
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\UnprotectHide.tiff ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe -
Drops startup file 5 IoCs
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe = "C:\\Windows\\System32\\ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe" ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exedescription ioc process File opened for modification C:\Users\Public\Libraries\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Public\Documents\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Public\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Music\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Public\Music\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2403053463-4052593947-3703345493-1000\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Links\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe -
Drops file in System32 directory 2 IoCs
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exedescription ioc process File created C:\Windows\System32\ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Windows\System32\Info.hta ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ja.pak.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-125_contrast-high.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\FM20ENU.DLL ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\ResourceDictionary.xbf ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_th.dll.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\vreg\word.x-none.msi.16.x-none.vreg.dat.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-400.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-environment-l1-1-0.dll.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-200.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\ImportFromDevice.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-disabled_32.svg.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ui-strings.js ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.155.85\msedgeupdateres_iw.dll.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Preview.scale-100_layoutdir-LTR.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\ui-strings.js.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\7-Zip\Lang\it.txt.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-40.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\ui-strings.js.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODATASERVICE.DLL ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\CIEXYZ.pf ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_altform-lightunplated.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dummy.aff ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\ui-strings.js ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons.png.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Hx.HxT.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\STINTL.DLL.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Linq.dll ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\npt.dll.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-96_altform-unplated.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\ui-strings.js.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\selector.js.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-output2.jar ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\ui-strings.js.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\core_zh_CN.jar ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-125.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\MedTile.scale-125.png ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBEUIRES.DLL.id-D0060156.[[email protected]].ROGER ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 5016 vssadmin.exe 1168 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exepid process 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3944 vssvc.exe Token: SeRestorePrivilege 3944 vssvc.exe Token: SeAuditPrivilege 3944 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.execmd.execmd.exedescription pid process target process PID 3868 wrote to memory of 1660 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe cmd.exe PID 3868 wrote to memory of 1660 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe cmd.exe PID 1660 wrote to memory of 4516 1660 cmd.exe mode.com PID 1660 wrote to memory of 4516 1660 cmd.exe mode.com PID 1660 wrote to memory of 5016 1660 cmd.exe vssadmin.exe PID 1660 wrote to memory of 5016 1660 cmd.exe vssadmin.exe PID 3868 wrote to memory of 4300 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe cmd.exe PID 3868 wrote to memory of 4300 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe cmd.exe PID 4300 wrote to memory of 3328 4300 cmd.exe mode.com PID 4300 wrote to memory of 3328 4300 cmd.exe mode.com PID 4300 wrote to memory of 1168 4300 cmd.exe vssadmin.exe PID 4300 wrote to memory of 1168 4300 cmd.exe vssadmin.exe PID 3868 wrote to memory of 4848 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe mshta.exe PID 3868 wrote to memory of 4848 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe mshta.exe PID 3868 wrote to memory of 4132 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe mshta.exe PID 3868 wrote to memory of 4132 3868 ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe"C:\Users\Admin\AppData\Local\Temp\ddf8718ab5e3bdff7c88239fc3a69bfc1db49867301de0dd8ea02714a97ca479.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:4516
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5016 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3328
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1168 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:4848
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:4132
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3944
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5976d379b3afbbb1ac8f19e9bd3091e8d
SHA1d52822cef94a6fb1a46d47d895f0b05d6a3b0a20
SHA25669a9f2129e1a52c0c365a54e67cbdd84eec66ecf4030f8c56ce7733f73517ba0
SHA51279439524b1affbf6774de7949bde26ec40e084a2024bfd99c1f6ca9078e25cfb93f68c9da4c890c3948f4807d9e62037820ff713093bff7adb2488674fe28cc2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5976d379b3afbbb1ac8f19e9bd3091e8d
SHA1d52822cef94a6fb1a46d47d895f0b05d6a3b0a20
SHA25669a9f2129e1a52c0c365a54e67cbdd84eec66ecf4030f8c56ce7733f73517ba0
SHA51279439524b1affbf6774de7949bde26ec40e084a2024bfd99c1f6ca9078e25cfb93f68c9da4c890c3948f4807d9e62037820ff713093bff7adb2488674fe28cc2
-
memory/1168-142-0x0000000000000000-mapping.dmp
-
memory/1660-136-0x0000000000000000-mapping.dmp
-
memory/3328-141-0x0000000000000000-mapping.dmp
-
memory/3868-135-0x0000000006440000-0x0000000006459000-memory.dmpFilesize
100KB
-
memory/3868-134-0x0000000006420000-0x0000000006432000-memory.dmpFilesize
72KB
-
memory/3868-138-0x0000000000400000-0x00000000046D5000-memory.dmpFilesize
66.8MB
-
memory/4132-144-0x0000000000000000-mapping.dmp
-
memory/4300-140-0x0000000000000000-mapping.dmp
-
memory/4516-137-0x0000000000000000-mapping.dmp
-
memory/4848-143-0x0000000000000000-mapping.dmp
-
memory/5016-139-0x0000000000000000-mapping.dmp