Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 17:37
Static task
static1
Behavioral task
behavioral1
Sample
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe
Resource
win10v2004-20220414-en
General
-
Target
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe
-
Size
200KB
-
MD5
fd80e80c66e845241f572f13aaf0d9d0
-
SHA1
2af2cc6c7840e7a32e9460d8463a6d8a9c22c59a
-
SHA256
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34
-
SHA512
424119a5989754e12cda7e4d66f0971afc28cd5f0dfcb1c125b2ff283b05c31617ec9b0fdaea815f7331c5dee7623b16d56028a90fac5d40c49f5e173d20c26d
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@sectex.net
admin@sectex.world
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\MoveUnlock.tiff 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe -
Drops startup file 5 IoCs
Processes:
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe = "C:\\Windows\\System32\\3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe" 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exedescription ioc process File opened for modification C:\Program Files\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N4DR1BTE\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\Links\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\Music\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2HTZSS82\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I7JGZPUA\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\PWZ8QZ9F\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Music\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Public\Videos\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8WU7A3BP\desktop.ini 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe -
Drops file in System32 directory 2 IoCs
Processes:
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exedescription ioc process File created C:\Windows\System32\3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Windows\System32\Info.hta 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe -
Drops file in Program Files directory 64 IoCs
Processes:
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\PREVIEW.GIF 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0318448.WMF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLVBS.DLL.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00633_.WMF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_sv.dll.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\weather.css 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21370_.GIF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Teal.css.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Newsprint.eftx 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\StarterApplicationDescriptors.xml.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301076.WMF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files\Java\jre7\bin\dcpr.dll.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCF.DLL.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\splash.gif 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\BTOPENWORLD.COM.XML.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NL7Models0011.DLL.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174952.JPG.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01840_.GIF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPML.ICO 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FS3BOX.POC.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00525_.WMF 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKACCS.ICO 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00703L.GIF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\SessionOwner.ico 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\nacl_irt_x86_64.nexe.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18243_.WMF 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18198_.WMF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\BloodPressureTracker.xltx.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0281243.WMF.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21310_.GIF 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_en-GB.dll.id-EA5B30DC.[admin@sectex.net].bot 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1496 vssadmin.exe 1772 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exepid process 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 524 vssvc.exe Token: SeRestorePrivilege 524 vssvc.exe Token: SeAuditPrivilege 524 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.execmd.execmd.exedescription pid process target process PID 2028 wrote to memory of 1464 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe cmd.exe PID 2028 wrote to memory of 1464 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe cmd.exe PID 2028 wrote to memory of 1464 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe cmd.exe PID 2028 wrote to memory of 1464 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe cmd.exe PID 1464 wrote to memory of 1408 1464 cmd.exe mode.com PID 1464 wrote to memory of 1408 1464 cmd.exe mode.com PID 1464 wrote to memory of 1408 1464 cmd.exe mode.com PID 1464 wrote to memory of 1772 1464 cmd.exe vssadmin.exe PID 1464 wrote to memory of 1772 1464 cmd.exe vssadmin.exe PID 1464 wrote to memory of 1772 1464 cmd.exe vssadmin.exe PID 2028 wrote to memory of 596 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe cmd.exe PID 2028 wrote to memory of 596 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe cmd.exe PID 2028 wrote to memory of 596 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe cmd.exe PID 2028 wrote to memory of 596 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe cmd.exe PID 596 wrote to memory of 1844 596 cmd.exe mode.com PID 596 wrote to memory of 1844 596 cmd.exe mode.com PID 596 wrote to memory of 1844 596 cmd.exe mode.com PID 596 wrote to memory of 1496 596 cmd.exe vssadmin.exe PID 596 wrote to memory of 1496 596 cmd.exe vssadmin.exe PID 596 wrote to memory of 1496 596 cmd.exe vssadmin.exe PID 2028 wrote to memory of 1448 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe mshta.exe PID 2028 wrote to memory of 1448 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe mshta.exe PID 2028 wrote to memory of 1448 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe mshta.exe PID 2028 wrote to memory of 1448 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe mshta.exe PID 2028 wrote to memory of 684 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe mshta.exe PID 2028 wrote to memory of 684 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe mshta.exe PID 2028 wrote to memory of 684 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe mshta.exe PID 2028 wrote to memory of 684 2028 3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe"C:\Users\Admin\AppData\Local\Temp\3929729e7b0f42902887cc1739b6dc23a2ae916e476e6ed32177d26a52f82d34.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD50ac53bbe7aeca2e03425f4bd74b93dc4
SHA19deca4f2ea1c8715c1330bed802edd5a3e15911e
SHA256db7cee2bb13deb8c310301b139912e37a6fab2989a1befba1c8a590dcdaca230
SHA5121b4a8028faf305152e94af8f26954c22a7d5d7d050832a654932a712c17406dd4287e163388ba798be4503ab3619dd1a719ff3f641135c680b0b6c2145be4da7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD50ac53bbe7aeca2e03425f4bd74b93dc4
SHA19deca4f2ea1c8715c1330bed802edd5a3e15911e
SHA256db7cee2bb13deb8c310301b139912e37a6fab2989a1befba1c8a590dcdaca230
SHA5121b4a8028faf305152e94af8f26954c22a7d5d7d050832a654932a712c17406dd4287e163388ba798be4503ab3619dd1a719ff3f641135c680b0b6c2145be4da7
-
memory/596-62-0x0000000000000000-mapping.dmp
-
memory/684-66-0x0000000000000000-mapping.dmp
-
memory/684-87-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB
-
memory/684-67-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmpFilesize
8KB
-
memory/1408-57-0x0000000000000000-mapping.dmp
-
memory/1448-65-0x0000000000000000-mapping.dmp
-
memory/1464-56-0x0000000000000000-mapping.dmp
-
memory/1496-64-0x0000000000000000-mapping.dmp
-
memory/1772-58-0x0000000000000000-mapping.dmp
-
memory/1844-63-0x0000000000000000-mapping.dmp
-
memory/2028-54-0x0000000004FFB000-0x000000000500E000-memory.dmpFilesize
76KB
-
memory/2028-61-0x0000000004FFB000-0x000000000500E000-memory.dmpFilesize
76KB
-
memory/2028-60-0x0000000000400000-0x0000000004E8B000-memory.dmpFilesize
74.5MB
-
memory/2028-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/2028-59-0x0000000000220000-0x0000000000239000-memory.dmpFilesize
100KB