Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-05-2022 23:36
Static task
static1
Behavioral task
behavioral1
Sample
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
Resource
win10v2004-20220414-en
General
-
Target
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
-
Size
263KB
-
MD5
02062ed82e5359e9094eb74767e6a007
-
SHA1
9785f019e92675899d0284a1c293727c4afb0e4f
-
SHA256
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08
-
SHA512
268e2797a861c8b6c40ee7c0b36485e22ee3bf0bb1a3d22fc87c0cfb3f345b176509b23d989ff833df93fe233aae8ff2b02104b6f8d5e5a03d8c6107dca335fe
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\AssertJoin.tiff d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Pictures\UndoUpdate.tiff d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Pictures\UseUnblock.tiff d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Drops startup file 5 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe = "C:\\Windows\\System32\\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe" d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Music\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Music\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Documents\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3751123196-3323558407-1869646069-1000\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Links\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Desktop\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Videos\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Users\Public\Documents\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Drops file in System32 directory 2 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File created C:\Windows\System32\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Windows\System32\Info.hta d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-default.svg.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-125_contrast-high.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_f_col.hxk.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\PSGet.Resource.psd1.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle.cur.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\nn.pak.DATA.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-200_contrast-black.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\FM20.DLL.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.cpl d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\MapDarkTheme.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.dll.sig.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20_altform-unplated.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogo.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\iexplore.exe.mui d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-200.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Campfire.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-heap-l1-1-0.dll.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\nn.pak d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\moe_default_icon.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-white_scale-125.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_CopyNoDrop32x32.gif.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected].[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fil.pak.DATA.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\InModuleScope.Tests.ps1 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ja-jp\ui-strings.js.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-utility-l1-1-0.dll d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hu-hu\ui-strings.js.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.MsiProvider.dll.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaprsr.dll d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down-pressed.gif d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\javafx_iio.dll.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\j2pcsc.dll d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File created C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ml.dll.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\PackageLogo.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\MedTile.scale-125.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-24.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\share.svg.id-3A489508.[telegram_@spacedatax].ROGER d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\uncommon.lua d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\WideTile.scale-100.png d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1200 vssadmin.exe 2180 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exepid process 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2604 vssvc.exe Token: SeRestorePrivilege 2604 vssvc.exe Token: SeAuditPrivilege 2604 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.execmd.execmd.exedescription pid process target process PID 1540 wrote to memory of 5056 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1540 wrote to memory of 5056 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 5056 wrote to memory of 912 5056 cmd.exe mode.com PID 5056 wrote to memory of 912 5056 cmd.exe mode.com PID 5056 wrote to memory of 1200 5056 cmd.exe vssadmin.exe PID 5056 wrote to memory of 1200 5056 cmd.exe vssadmin.exe PID 1540 wrote to memory of 3876 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 1540 wrote to memory of 3876 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe cmd.exe PID 3876 wrote to memory of 5116 3876 cmd.exe mode.com PID 3876 wrote to memory of 5116 3876 cmd.exe mode.com PID 3876 wrote to memory of 2180 3876 cmd.exe vssadmin.exe PID 3876 wrote to memory of 2180 3876 cmd.exe vssadmin.exe PID 1540 wrote to memory of 4812 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1540 wrote to memory of 4812 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1540 wrote to memory of 3832 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe PID 1540 wrote to memory of 3832 1540 d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe"C:\Users\Admin\AppData\Local\Temp\d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:912
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1200 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:5116
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2180 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:4812
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:3832
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5aabe5258e68e964963c2f31bf4fea7d5
SHA1ce3733a4d9cdca195a100a2a1d36927dfec11275
SHA256c70afaa12dd39d506f7e4cbe7e8c5d4f8d459b395fdfc52f64b7194297fb5d42
SHA51216340e1dbf2427f83368e28e5bd73f39bc5f5e832d56f299add579bd9672104cd69b3702e7de3a1db708fc59f06ebe60d65adc64eb548851da0e2058f952c226
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5aabe5258e68e964963c2f31bf4fea7d5
SHA1ce3733a4d9cdca195a100a2a1d36927dfec11275
SHA256c70afaa12dd39d506f7e4cbe7e8c5d4f8d459b395fdfc52f64b7194297fb5d42
SHA51216340e1dbf2427f83368e28e5bd73f39bc5f5e832d56f299add579bd9672104cd69b3702e7de3a1db708fc59f06ebe60d65adc64eb548851da0e2058f952c226
-
memory/912-131-0x0000000000000000-mapping.dmp
-
memory/1200-135-0x0000000000000000-mapping.dmp
-
memory/1540-132-0x0000000004F97000-0x0000000004FAA000-memory.dmpFilesize
76KB
-
memory/1540-133-0x0000000004E00000-0x0000000004E19000-memory.dmpFilesize
100KB
-
memory/1540-134-0x0000000000400000-0x0000000004DBA000-memory.dmpFilesize
73.7MB
-
memory/2180-138-0x0000000000000000-mapping.dmp
-
memory/3832-140-0x0000000000000000-mapping.dmp
-
memory/3876-136-0x0000000000000000-mapping.dmp
-
memory/4812-139-0x0000000000000000-mapping.dmp
-
memory/5056-130-0x0000000000000000-mapping.dmp
-
memory/5116-137-0x0000000000000000-mapping.dmp