Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-05-2022 23:36
Static task
static1
Behavioral task
behavioral1
Sample
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
Resource
win10v2004-20220414-en
General
-
Target
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
-
Size
263KB
-
MD5
02062ed82e5359e9094eb74767e6a007
-
SHA1
9785f019e92675899d0284a1c293727c4afb0e4f
-
SHA256
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08
-
SHA512
268e2797a861c8b6c40ee7c0b36485e22ee3bf0bb1a3d22fc87c0cfb3f345b176509b23d989ff833df93fe233aae8ff2b02104b6f8d5e5a03d8c6107dca335fe
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\StepRead.tiff d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Drops startup file 5 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe = "C:\\Windows\\System32\\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe" d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Desktop\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CJ062DYL\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Links\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\3M5UMK08\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CARP68LT\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z2WKUPBM\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Music\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Videos\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QOAS6PU9\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Drops file in System32 directory 2 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File created C:\Windows\System32\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Windows\System32\Info.hta d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\AcroRead.msi.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado28.tlb d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OFFLINE.ICO d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\VSTAClientPkgUI.dll.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\Java\jre7\lib\zi\America\Atikokan.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01748_.GIF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ACT3.SAM d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10337_.GIF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPORTL.ICO.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\7-Zip\descript.ion d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115842.GIF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\ARROW.WAV d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105320.WMF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL104.XML.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PS10TARG.POC.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152690.WMF d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02950_.WMF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSN.ICO.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14768_.GIF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_cloudy.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0301418.WMF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Users.accdt.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jre7\bin\deploy.dll d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14866_.GIF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21333_.GIF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_COL.HXC.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado21.tlb d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\YEAR.XSL.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\F12Tools.dll.mui d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152722.WMF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF.id-04F95169.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115841.GIF d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 620 vssadmin.exe 1592 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exepid process 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1444 vssvc.exe Token: SeRestorePrivilege 1444 vssvc.exe Token: SeAuditPrivilege 1444 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.execmd.execmd.exedescription pid process target process PID 1652 wrote to memory of 2032 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1652 wrote to memory of 2032 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1652 wrote to memory of 2032 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1652 wrote to memory of 2032 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 2032 wrote to memory of 1320 2032 cmd.exe mode.com PID 2032 wrote to memory of 1320 2032 cmd.exe mode.com PID 2032 wrote to memory of 1320 2032 cmd.exe mode.com PID 2032 wrote to memory of 620 2032 cmd.exe vssadmin.exe PID 2032 wrote to memory of 620 2032 cmd.exe vssadmin.exe PID 2032 wrote to memory of 620 2032 cmd.exe vssadmin.exe PID 1652 wrote to memory of 1776 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1652 wrote to memory of 1776 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1652 wrote to memory of 1776 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1652 wrote to memory of 1776 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1776 wrote to memory of 1352 1776 cmd.exe mode.com PID 1776 wrote to memory of 1352 1776 cmd.exe mode.com PID 1776 wrote to memory of 1352 1776 cmd.exe mode.com PID 1776 wrote to memory of 1592 1776 cmd.exe vssadmin.exe PID 1776 wrote to memory of 1592 1776 cmd.exe vssadmin.exe PID 1776 wrote to memory of 1592 1776 cmd.exe vssadmin.exe PID 1652 wrote to memory of 1856 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1652 wrote to memory of 1856 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1652 wrote to memory of 1856 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1652 wrote to memory of 1856 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1652 wrote to memory of 664 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1652 wrote to memory of 664 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1652 wrote to memory of 664 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1652 wrote to memory of 664 1652 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe"C:\Users\Admin\AppData\Local\Temp\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1320
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:620 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1352
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1592 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:1856 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:664
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5400dc1b9a54327d0a857346e02da1d05
SHA1567ffab1f7776811d16d5b72fab5433e926d1511
SHA256482ca6e925bb74bc15c962849ac0eaf16e4c600c01ee82c7dbb1ce240a9fbd2d
SHA512b2bcafd2284cedf2263342954b81f0f1117aa15605e4ba75ad3da8251f363f9bd44adb2154bade20bf71b3faa8bd202f830f51d84713bd9bf7d62024f78ef50c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5400dc1b9a54327d0a857346e02da1d05
SHA1567ffab1f7776811d16d5b72fab5433e926d1511
SHA256482ca6e925bb74bc15c962849ac0eaf16e4c600c01ee82c7dbb1ce240a9fbd2d
SHA512b2bcafd2284cedf2263342954b81f0f1117aa15605e4ba75ad3da8251f363f9bd44adb2154bade20bf71b3faa8bd202f830f51d84713bd9bf7d62024f78ef50c
-
memory/620-57-0x0000000000000000-mapping.dmp
-
memory/664-65-0x0000000000000000-mapping.dmp
-
memory/1320-56-0x0000000000000000-mapping.dmp
-
memory/1352-62-0x0000000000000000-mapping.dmp
-
memory/1592-63-0x0000000000000000-mapping.dmp
-
memory/1652-60-0x0000000000400000-0x0000000004DBA000-memory.dmpFilesize
73.7MB
-
memory/1652-54-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1652-59-0x0000000000020000-0x0000000000039000-memory.dmpFilesize
100KB
-
memory/1652-58-0x0000000004F3A000-0x0000000004F4D000-memory.dmpFilesize
76KB
-
memory/1776-61-0x0000000000000000-mapping.dmp
-
memory/1856-64-0x0000000000000000-mapping.dmp
-
memory/1856-66-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmpFilesize
8KB
-
memory/2032-55-0x0000000000000000-mapping.dmp