Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-04-2022 17:55
Static task
static1
Behavioral task
behavioral1
Sample
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe
Resource
win10v2004-20220414-en
General
-
Target
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe
-
Size
137KB
-
MD5
1588b9699197251449436d8bffd43f02
-
SHA1
2f88dc09a8a2f237909417684ec428e296812ce4
-
SHA256
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc
-
SHA512
e9b5c911866b15cd55a9f80fcae2af3faa7a732fc0317c7592b3337350dd428b45163f56969c78db82a800a07b3e84f0d01b6d38d413af47210b282203dba02a
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe = "C:\\Windows\\System32\\e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe" e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe -
Drops desktop.ini file(s) 13 IoCs
Processes:
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exedescription ioc process File opened for modification C:\Program Files\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1083475884-596052423-1669053738-1000\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe -
Drops file in System32 directory 1 IoCs
Processes:
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exedescription ioc process File created C:\Windows\System32\e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\nl.pak e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\PREVIEW.GIF e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382967.JPG e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32r.dll e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\PREVIEW.GIF e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jre7\lib\ext\meta-index.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_OFF.GIF.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jre7\bin\pack200.exe.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02074_.GIF e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jre7\lib\resources.jar.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Denver e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\CANYON.INF.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\PREVIEW.GIF.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182689.JPG.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02282_.WMF.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jre7\lib\management\snmp.acl.template.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue.css.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02886_.WMF e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.id-20B6B397.[[email protected]].ROGER e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2008 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exepid process 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1080 vssvc.exe Token: SeRestorePrivilege 1080 vssvc.exe Token: SeAuditPrivilege 1080 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.execmd.exedescription pid process target process PID 1100 wrote to memory of 360 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe cmd.exe PID 1100 wrote to memory of 360 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe cmd.exe PID 1100 wrote to memory of 360 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe cmd.exe PID 1100 wrote to memory of 360 1100 e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe cmd.exe PID 360 wrote to memory of 1780 360 cmd.exe mode.com PID 360 wrote to memory of 1780 360 cmd.exe mode.com PID 360 wrote to memory of 1780 360 cmd.exe mode.com PID 360 wrote to memory of 2008 360 cmd.exe vssadmin.exe PID 360 wrote to memory of 2008 360 cmd.exe vssadmin.exe PID 360 wrote to memory of 2008 360 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe"C:\Users\Admin\AppData\Local\Temp\e0ba6d5159e2b2670a938af70100717a5858ed48e66451e4374b133bc0ce84bc.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1780
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2008
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/360-55-0x0000000000000000-mapping.dmp
-
memory/1100-54-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/1100-58-0x00000000030BB000-0x00000000030CE000-memory.dmpFilesize
76KB
-
memory/1100-59-0x0000000000220000-0x0000000000239000-memory.dmpFilesize
100KB
-
memory/1100-60-0x0000000000400000-0x0000000002FAE000-memory.dmpFilesize
43.7MB
-
memory/1780-56-0x0000000000000000-mapping.dmp
-
memory/2008-57-0x0000000000000000-mapping.dmp