Analysis
-
max time kernel
171s -
max time network
79s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 04:29
Static task
static1
Behavioral task
behavioral1
Sample
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe
Resource
win10v2004-20220414-en
General
-
Target
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe
-
Size
420KB
-
MD5
94c8ea0deb405d08c7570a1f93b447cd
-
SHA1
0d799c99ca98d2383425dff3ce9cb9cdbcbb9a85
-
SHA256
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a
-
SHA512
2e457f4442e4dbf4cd9e53272c9948d63bc881b590244f37d584b8fefb6976a7893d02a7574ebe2c5e4d2756143bf4527ce520a69fe9a6b17ab470a8e4f37ef7
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe = "C:\\Windows\\System32\\faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe" faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe -
Drops desktop.ini file(s) 13 IoCs
Processes:
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe -
Drops file in System32 directory 1 IoCs
Processes:
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exedescription ioc process File created C:\Windows\System32\faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe -
Drops file in Program Files directory 64 IoCs
Processes:
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0278882.WMF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\HEADER.GIF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285750.WMF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00476_.WMF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21319_.GIF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_ON.GIF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15134_.GIF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21294_.GIF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Windows Journal\jnwppr.dll faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293236.WMF faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03464_.WMF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02886_.WMF faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLPERF.H.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01474_.WMF faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ENGIDX.DAT.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01291_.WMF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216570.WMF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Microsoft Games\More Games\MoreGames.dll.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsMacroTemplate.html faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME43.CSS.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif.id-B6ACF351.[admin@sectex.net].bot faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1384 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exepid process 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1376 vssvc.exe Token: SeRestorePrivilege 1376 vssvc.exe Token: SeAuditPrivilege 1376 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.execmd.exedescription pid process target process PID 280 wrote to memory of 1420 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe cmd.exe PID 280 wrote to memory of 1420 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe cmd.exe PID 280 wrote to memory of 1420 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe cmd.exe PID 280 wrote to memory of 1420 280 faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe cmd.exe PID 1420 wrote to memory of 1852 1420 cmd.exe mode.com PID 1420 wrote to memory of 1852 1420 cmd.exe mode.com PID 1420 wrote to memory of 1852 1420 cmd.exe mode.com PID 1420 wrote to memory of 1384 1420 cmd.exe vssadmin.exe PID 1420 wrote to memory of 1384 1420 cmd.exe vssadmin.exe PID 1420 wrote to memory of 1384 1420 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe"C:\Users\Admin\AppData\Local\Temp\faf32ce85c3e7c316453ab155c59a55af95754fa57ef9c7f87b9b23a139fba9a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/280-54-0x0000000075541000-0x0000000075543000-memory.dmpFilesize
8KB
-
memory/280-55-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/280-56-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/280-60-0x0000000000480000-0x00000000004B7000-memory.dmpFilesize
220KB
-
memory/1384-59-0x0000000000000000-mapping.dmp
-
memory/1420-57-0x0000000000000000-mapping.dmp
-
memory/1852-58-0x0000000000000000-mapping.dmp