dharma | e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568

General

Target

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
Size

266KB
MD5

2cecd79470cd71227a29740d9bada0f2
SHA1

96f6e20475d1bf4ab7668718ebfc2887a3d49d98
SHA256

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568
SHA512

71e4d35e4d885989b46a9117955151a8d1a0736b626e593b0ab41b70b92ef8c875ba3f3b3f9a1044bb557667fbc5661a92b396dd76ab86c1f6dd01bfcadaedf2

Score

10^/10

dharma persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

Processes:

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe = "C:\\Windows\\System32\\e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe"	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1081944012-3634099177-1681222835-1000\desktop.ini	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\desktop.ini	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

Drops file in System32 directory 1 IoCs

Processes:

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

description	ioc	process
File created	C:\Windows\System32\e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

Drops file in Program Files directory 64 IoCs

Processes:

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\content-types.properties	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ml.pak	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ko_KR.jar.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.bat.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\youtube.crx.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-awt.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\j2pkcs11.dll	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javafx_font.dll	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\README.txt.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\sRGB.pf.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\include\jvmticmlr.h.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\prism_common.dll	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Internet Explorer\images\bing.ico	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496926556.profile.gz.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\id.pak.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\decora_sse.dll.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\splash.gif.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\vi.pak.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.id-82008A51.[telegram_@spacedatax].ROGER	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

Program crash 43 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3100	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3708	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
1440	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3788	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3884	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
1296	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4280	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3172	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2132	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
440	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4980	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
872	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
752	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4668	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
864	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2524	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
1992	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4136	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3112	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3992	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4852	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2164	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
1572	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4680	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4568	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4828	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4404	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3380	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3940	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2120	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
276	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
1332	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2500	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4844	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
3856	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4160	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4648	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2888	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4880	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
1636	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4320	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2656	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
4280	2628	WerFault.exe	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

4904 vssadmin.exe

pid	process
4904	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

pid	process
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2056 vssvc.exe
Token: SeRestorePrivilege 2056 vssvc.exe
Token: SeAuditPrivilege 2056 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	2056	vssvc.exe
Token: SeRestorePrivilege	2056	vssvc.exe
Token: SeAuditPrivilege	2056	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.execmd.exe

description	pid	process	target process
PID 2628 wrote to memory of 3012	2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe	cmd.exe
PID 2628 wrote to memory of 3012	2628	e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe	cmd.exe
PID 3012 wrote to memory of 4364	3012	cmd.exe	mode.com
PID 3012 wrote to memory of 4364	3012	cmd.exe	mode.com
PID 3012 wrote to memory of 4904	3012	cmd.exe	vssadmin.exe
PID 3012 wrote to memory of 4904	3012	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe
"C:\Users\Admin\AppData\Local\Temp\e42feb8039597dd71287304e097411bb27fd54fc29bbfcdc87ceb5d111738568.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:4364

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 624
2⤵
- Program crash
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 620
2⤵
- Program crash
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 672
2⤵
- Program crash
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 668
2⤵
- Program crash
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 620
2⤵
- Program crash
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 620
2⤵
- Program crash
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 736
2⤵
- Program crash
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 776
2⤵
- Program crash
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 812
2⤵
- Program crash
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 820
2⤵
- Program crash
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 812
2⤵
- Program crash
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 880
2⤵
- Program crash
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 872
2⤵
- Program crash
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 908
2⤵
- Program crash
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 928
2⤵
- Program crash
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 936
2⤵
- Program crash
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 916
2⤵
- Program crash
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 892
2⤵
- Program crash
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 896
2⤵
- Program crash
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 872
2⤵
- Program crash
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 888
2⤵
- Program crash
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 788
2⤵
- Program crash
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 768
2⤵
- Program crash
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 812
2⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 932
2⤵
- Program crash
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 824
2⤵
- Program crash
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 852
2⤵
- Program crash
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 856
2⤵
- Program crash
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 924
2⤵
- Program crash
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 916
2⤵
- Program crash
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 888
2⤵
- Program crash
PID:276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 788
2⤵
- Program crash
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 936
2⤵
- Program crash
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 856
2⤵
- Program crash
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 880
2⤵
- Program crash
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 816
2⤵
- Program crash
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 852
2⤵
- Program crash
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 820
2⤵
- Program crash
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 668
2⤵
- Program crash
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 968
2⤵
- Program crash
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 712
2⤵
- Program crash
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 1008
2⤵
- Program crash
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 1004
2⤵
- Program crash
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2628 -ip 2628
1⤵
PID:224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2628 -ip 2628
1⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2628 -ip 2628
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2628 -ip 2628
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2628 -ip 2628
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2628 -ip 2628
1⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2628 -ip 2628
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2628 -ip 2628
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2628 -ip 2628
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2628 -ip 2628
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2628 -ip 2628
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2628 -ip 2628
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2628 -ip 2628
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2628 -ip 2628
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2628 -ip 2628
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2628 -ip 2628
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2628 -ip 2628
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2628 -ip 2628
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2628 -ip 2628
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2628 -ip 2628
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2628 -ip 2628
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2628 -ip 2628
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2628 -ip 2628
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2628 -ip 2628
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2628 -ip 2628
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2628 -ip 2628
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2628 -ip 2628
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 2628 -ip 2628
1⤵
PID:608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 2628 -ip 2628
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2628 -ip 2628
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2628 -ip 2628
1⤵
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2628 -ip 2628
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 2628 -ip 2628
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2628 -ip 2628
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 2628 -ip 2628
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2628 -ip 2628
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 2628 -ip 2628
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2628 -ip 2628
1⤵
PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 2628 -ip 2628
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2628 -ip 2628
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2628 -ip 2628
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 2628 -ip 2628
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 2628 -ip 2628
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-130-0x0000000000DFA000-0x0000000000E0D000-memory.dmp

Filesize
76KB

Download
memory/2628-131-0x0000000000DB0000-0x0000000000DC9000-memory.dmp

Filesize
100KB

Download
memory/2628-132-0x0000000000400000-0x0000000000C1C000-memory.dmp

Filesize
8.1MB

Download
memory/3012-133-0x0000000000000000-mapping.dmp

Download
memory/4364-134-0x0000000000000000-mapping.dmp

Download
memory/4904-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads