Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-06-2022 00:11
Static task
static1
Behavioral task
behavioral1
Sample
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe
Resource
win10v2004-20220414-en
General
-
Target
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe
-
Size
222KB
-
MD5
765e03856ba709f12220f31638ae237c
-
SHA1
6283d47cc404e866c7f68a0cebc71527ef31aecb
-
SHA256
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d
-
SHA512
45763abf8a8984117a5351b1d32af3df618d86fba35e8dd74be4c9f4c031c79eb72d423ccbb70287fd8a697b962cebb3164b49889b839ebdbde8eb3f6263be2e
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@sectex.net
admin@sectex.world
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe -
Drops startup file 5 IoCs
Processes:
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe = "C:\\Windows\\System32\\372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe" 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Public\Videos\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Public\Documents\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Public\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Links\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Public\Music\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Music\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe -
Drops file in System32 directory 2 IoCs
Processes:
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exedescription ioc process File created C:\Windows\System32\372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Windows\System32\Info.hta 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe -
Drops file in Program Files directory 64 IoCs
Processes:
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exedescription ioc process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ucrtbase.dll.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\ui-strings.js.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\ui-strings.js.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\boot_ja.jar 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\STSUPLD.DLL.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-16_altform-unplated_contrast-black.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Toast.svg.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\bg_get.svg.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Common Files\System\it-IT\wab32res.dll.mui 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\ui-strings.js 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files\7-Zip\Lang\ru.txt.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-white.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-2x.png.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcp140.dll.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\xmlrw_xl.dll.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\PREVIEW.GIF.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-125.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-lightunplated.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-48_altform-unplated_contrast-high.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover_2x.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Fonts\MapsMDL2.2.34.ttf 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADALPREVIOUS.DLL.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-32_altform-lightunplated.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteLargeTile.scale-400.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\pstn\PSTN_phone.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main-selector.css.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.157.61\msedgeupdateres_ca-Es-VALENCIA.dll.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Fonts\CamMDL2.2.07.ttf 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\THMBNAIL.PNG.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxManifest.xml 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-80_altform-unplated.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\comment.svg.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ui-strings.js.id-925FBE5B.[admin@sectex.net].bot 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-100_contrast-white.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\wmpnssci.dll.mui 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1172 vssadmin.exe 1720 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exepid process 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1992 vssvc.exe Token: SeRestorePrivilege 1992 vssvc.exe Token: SeAuditPrivilege 1992 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.execmd.execmd.exedescription pid process target process PID 4052 wrote to memory of 2632 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe cmd.exe PID 4052 wrote to memory of 2632 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe cmd.exe PID 2632 wrote to memory of 4892 2632 cmd.exe mode.com PID 2632 wrote to memory of 4892 2632 cmd.exe mode.com PID 2632 wrote to memory of 1720 2632 cmd.exe vssadmin.exe PID 2632 wrote to memory of 1720 2632 cmd.exe vssadmin.exe PID 4052 wrote to memory of 632 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe cmd.exe PID 4052 wrote to memory of 632 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe cmd.exe PID 632 wrote to memory of 280 632 cmd.exe mode.com PID 632 wrote to memory of 280 632 cmd.exe mode.com PID 632 wrote to memory of 1172 632 cmd.exe vssadmin.exe PID 632 wrote to memory of 1172 632 cmd.exe vssadmin.exe PID 4052 wrote to memory of 1824 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe mshta.exe PID 4052 wrote to memory of 1824 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe mshta.exe PID 4052 wrote to memory of 4088 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe mshta.exe PID 4052 wrote to memory of 4088 4052 372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe"C:\Users\Admin\AppData\Local\Temp\372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD536d43455f9070030207c2a947caa0bf4
SHA1a2772e08283f8a955d084b10f6d98ba51af4fc41
SHA256185f633d8e32210cfda62cb03ea3d4bb4335bee5b2f82ee57d9d326014c03139
SHA5124bf31fadfd70582cfb3ddddbc71194c2020df1fc124fdbf985ac577030df07f06aefed56ca44872c77672afd67ddf6cd0e74dbc0b767f8a16d6763cd2b23c61f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD536d43455f9070030207c2a947caa0bf4
SHA1a2772e08283f8a955d084b10f6d98ba51af4fc41
SHA256185f633d8e32210cfda62cb03ea3d4bb4335bee5b2f82ee57d9d326014c03139
SHA5124bf31fadfd70582cfb3ddddbc71194c2020df1fc124fdbf985ac577030df07f06aefed56ca44872c77672afd67ddf6cd0e74dbc0b767f8a16d6763cd2b23c61f
-
memory/280-138-0x0000000000000000-mapping.dmp
-
memory/632-137-0x0000000000000000-mapping.dmp
-
memory/1172-139-0x0000000000000000-mapping.dmp
-
memory/1720-135-0x0000000000000000-mapping.dmp
-
memory/1824-140-0x0000000000000000-mapping.dmp
-
memory/2632-130-0x0000000000000000-mapping.dmp
-
memory/4052-133-0x0000000000400000-0x0000000000528000-memory.dmpFilesize
1.2MB
-
memory/4052-136-0x0000000000737000-0x000000000074A000-memory.dmpFilesize
76KB
-
memory/4052-132-0x0000000000650000-0x0000000000669000-memory.dmpFilesize
100KB
-
memory/4052-131-0x0000000000737000-0x000000000074A000-memory.dmpFilesize
76KB
-
memory/4088-141-0x0000000000000000-mapping.dmp
-
memory/4892-134-0x0000000000000000-mapping.dmp