Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 22:31
Static task
static1
Behavioral task
behavioral1
Sample
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe
Resource
win10v2004-20220721-en
General
-
Target
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe
-
Size
218KB
-
MD5
86e43b97d07548d1910a58c20058c74b
-
SHA1
f5d0274f1f1e28a6ce4928255a8f10cacfded006
-
SHA256
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2
-
SHA512
3269a54b317c477801064dd8a70da8fed69bc3c2b35f460824238bf24840235188c462a92c93404adf39f47b756b90d9a7eb471168d1b64e87fc6a1e14d230a2
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@sectex.net
admin@sectex.world
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SubmitComplete.tiff e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Pictures\UninstallAssert.tiff e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe -
Drops startup file 5 IoCs
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe = "C:\\Windows\\System32\\e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe" e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\Pictures\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\Downloads\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Links\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Videos\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\Music\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Searches\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Documents\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\Libraries\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\Videos\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\Documents\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Public\Desktop\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Music\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe -
Drops file in System32 directory 2 IoCs
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exedescription ioc process File created C:\Windows\System32\e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Windows\System32\Info.hta e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\THMBNAIL.PNG.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SmallTile.scale-125.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\ui-strings.js e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-400.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\SmallTile.scale-200.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\version.js.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-400_contrast-white.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-100_contrast-black.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-150.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-72_altform-unplated.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSOUC.16.1033.hxn e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jfr.dll e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48_altform-lightunplated.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nb-no\ui-strings.js.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\ui-strings.js.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\OperationValidationResources.psd1 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-execution.jar.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-400.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalSplashScreen.scale-200.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-200.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-150.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32_altform-unplated.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\ui-strings.js.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-400_contrast-black.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\ui-strings.js.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\ui-strings.js.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.scale-125.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-unplated.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\ui-strings.js.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-24_altform-unplated_contrast-black.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail2x.png.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.winmd e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ga.pak.DATA e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_ug.dll.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-io.jar e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\82.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_pdf_18.svg.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File created C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.Primitives.dll e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.id-D5BDA174.[admin@sectex.net].bot e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\winsdkfb\Images\fb_blank_profile_portrait.png e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2948 vssadmin.exe 4280 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exepid process 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2028 vssvc.exe Token: SeRestorePrivilege 2028 vssvc.exe Token: SeAuditPrivilege 2028 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.execmd.execmd.exedescription pid process target process PID 4768 wrote to memory of 1976 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe cmd.exe PID 4768 wrote to memory of 1976 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe cmd.exe PID 1976 wrote to memory of 2460 1976 cmd.exe mode.com PID 1976 wrote to memory of 2460 1976 cmd.exe mode.com PID 1976 wrote to memory of 4280 1976 cmd.exe vssadmin.exe PID 1976 wrote to memory of 4280 1976 cmd.exe vssadmin.exe PID 4768 wrote to memory of 3244 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe cmd.exe PID 4768 wrote to memory of 3244 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe cmd.exe PID 3244 wrote to memory of 3824 3244 cmd.exe mode.com PID 3244 wrote to memory of 3824 3244 cmd.exe mode.com PID 3244 wrote to memory of 2948 3244 cmd.exe vssadmin.exe PID 3244 wrote to memory of 2948 3244 cmd.exe vssadmin.exe PID 4768 wrote to memory of 3188 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe mshta.exe PID 4768 wrote to memory of 3188 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe mshta.exe PID 4768 wrote to memory of 1752 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe mshta.exe PID 4768 wrote to memory of 1752 4768 e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe"C:\Users\Admin\AppData\Local\Temp\e7c07f9ed71d4819d022fedbcb8bcc3162c368caa1ddad3838420b6bb73173e2.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD54b4a52138a3c35bfe0559d5112ca8dd4
SHA104611375bae6db9c198fb1a15a02886160cd7a47
SHA25643b661ebf24e9507ea26f88a5b77e18bdcecf1967422e013701546f786df583f
SHA512776de4e46e85bd83c3b2e456dfe1f34f093e5ca3c0f203b43f95966caa6794e8824c85567ee10a75a5c61b345726935c31a1bf46f770a466016c9f2901e4a5f1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD54b4a52138a3c35bfe0559d5112ca8dd4
SHA104611375bae6db9c198fb1a15a02886160cd7a47
SHA25643b661ebf24e9507ea26f88a5b77e18bdcecf1967422e013701546f786df583f
SHA512776de4e46e85bd83c3b2e456dfe1f34f093e5ca3c0f203b43f95966caa6794e8824c85567ee10a75a5c61b345726935c31a1bf46f770a466016c9f2901e4a5f1
-
memory/1752-141-0x0000000000000000-mapping.dmp
-
memory/1976-130-0x0000000000000000-mapping.dmp
-
memory/2460-131-0x0000000000000000-mapping.dmp
-
memory/2948-139-0x0000000000000000-mapping.dmp
-
memory/3188-140-0x0000000000000000-mapping.dmp
-
memory/3244-137-0x0000000000000000-mapping.dmp
-
memory/3824-138-0x0000000000000000-mapping.dmp
-
memory/4280-134-0x0000000000000000-mapping.dmp
-
memory/4768-132-0x0000000004F2D000-0x0000000004F40000-memory.dmpFilesize
76KB
-
memory/4768-136-0x0000000004F2D000-0x0000000004F40000-memory.dmpFilesize
76KB
-
memory/4768-135-0x0000000000400000-0x0000000004E8F000-memory.dmpFilesize
74.6MB
-
memory/4768-133-0x0000000006BC0000-0x0000000006BD9000-memory.dmpFilesize
100KB