dharma | e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2022 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
Size

291KB
MD5

25dad6ce880d6ca55c66a3e32d380a83
SHA1

af2cd7985b3805cac94160c29782f62489a981fc
SHA256

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6
SHA512

0b653399ca3ee5cb71ae06b7da5e0fd123cd165cb6ecd1b41f2c0109ae4327612a8def1e8f3c37284096d7a422c0f2ea4bb87d75bc8c96e7012d13527f9b490e

Score

10^/10

dharma persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 8972133E In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ResetProtect.tiff	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Pictures\SkipCompress.tiff	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Drops startup file 5 IoCs

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe = "C:\\Windows\\System32\\e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe"	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2660308776-3705150086-26593515-1000\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Public\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Drops file in System32 directory 2 IoCs

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

description	ioc	process
File created	C:\Windows\System32\e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Windows\System32\Info.hta	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Drops file in Program Files directory 64 IoCs

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-200_contrast-black.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\SmallTile.scale-200.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\Email.ot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\vccorlib140.dll.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_altform-unplated_contrast-white.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-256_altform-lightunplated.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\ui-strings.js.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\mi.pak	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-150_contrast-black.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaTypewriterBold.ttf.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Microsoft.AnalysisServices.AzureClient.dll.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\wintlim.dll	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\ui-strings.js.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-30_altform-unplated_contrast-white.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\plugin.js.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\PREVIEW.GIF.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-100.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\ui-strings.js.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileLargeSquare.scale-200.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square150x150Logo.scale-200.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarMediumTile.scale-400.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYHBD.TTC.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-200_contrast-white.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-ma\ui-strings.js	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\CompareDismount.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-400.png	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de_2x.gif.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.schema.mfl.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.strings.psd1	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinResearcher.xml	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main-selector.css	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.id-8972133E.[[email protected]].bot	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.ini	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 63 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5032	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3592	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3768	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1176	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4592	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4952	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3692	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4988	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4664	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1396	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2276	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3152	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1968	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
5088	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1108	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2140	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2592	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2932	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2972	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4884	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4020	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2476	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3288	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4556	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4484	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4224	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4072	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2596	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1976	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2616	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4896	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
288	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1264	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1800	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4132	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2956	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
5060	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4640	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3416	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4776	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4544	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4008	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2420	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
5036	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4948	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4444	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4840	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
100	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4280	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3560	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1088	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1540	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1908	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
908	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4572	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3532	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3696	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4804	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
1372	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
3648	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
2008	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4876	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4256	4636	WerFault.exe	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1828 vssadmin.exe
1904 vssadmin.exe

pid	process
1828	vssadmin.exe
1904	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

pid	process
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 4140 vssvc.exe
Token: SeRestorePrivilege 4140 vssvc.exe
Token: SeAuditPrivilege 4140 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	4140	vssvc.exe
Token: SeRestorePrivilege	4140	vssvc.exe
Token: SeAuditPrivilege	4140	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.execmd.execmd.exe

description	pid	process	target process
PID 4636 wrote to memory of 1416	4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	cmd.exe
PID 4636 wrote to memory of 1416	4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	cmd.exe
PID 1416 wrote to memory of 3484	1416	cmd.exe	mode.com
PID 1416 wrote to memory of 3484	1416	cmd.exe	mode.com
PID 1416 wrote to memory of 1828	1416	cmd.exe	vssadmin.exe
PID 1416 wrote to memory of 1828	1416	cmd.exe	vssadmin.exe
PID 4636 wrote to memory of 4660	4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	cmd.exe
PID 4636 wrote to memory of 4660	4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	cmd.exe
PID 4660 wrote to memory of 2936	4660	cmd.exe	mode.com
PID 4660 wrote to memory of 2936	4660	cmd.exe	mode.com
PID 4660 wrote to memory of 1904	4660	cmd.exe	vssadmin.exe
PID 4660 wrote to memory of 1904	4660	cmd.exe	vssadmin.exe
PID 4636 wrote to memory of 3384	4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	mshta.exe
PID 4636 wrote to memory of 3384	4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	mshta.exe
PID 4636 wrote to memory of 1364	4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	mshta.exe
PID 4636 wrote to memory of 1364	4636	e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe
"C:\Users\Admin\AppData\Local\Temp\e66f45509b5ab1ddd411ae19c3f3c47b54aaf730b2411b74e48176e2dbb169f6.exe"
1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:3484
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 520
  2⤵
  - Program crash
  PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 560
  2⤵
  - Program crash
  PID:3592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 568
  2⤵
  - Program crash
  PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 556
  2⤵
  - Program crash
  PID:1176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 600
  2⤵
  - Program crash
  PID:4592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 540
  2⤵
  - Program crash
  PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 628
  2⤵
  - Program crash
  PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 672
  2⤵
  - Program crash
  PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 724
  2⤵
  - Program crash
  PID:4664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 740
  2⤵
  - Program crash
  PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 708
  2⤵
  - Program crash
  PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 732
  2⤵
  - Program crash
  PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 752
  2⤵
  - Program crash
  PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 788
  2⤵
  - Program crash
  PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 808
  2⤵
  - Program crash
  PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 796
  2⤵
  - Program crash
  PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 824
  2⤵
  - Program crash
  PID:2592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 760
  2⤵
  - Program crash
  PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 728
  2⤵
  - Program crash
  PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 768
  2⤵
  - Program crash
  PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 756
  2⤵
  - Program crash
  PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 680
  2⤵
  - Program crash
  PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 672
  2⤵
  - Program crash
  PID:3288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 740
  2⤵
  - Program crash
  PID:4556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 684
  2⤵
  - Program crash
  PID:4484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 864
  2⤵
  - Program crash
  PID:4224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 912
  2⤵
  - Program crash
  PID:4072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 920
  2⤵
  - Program crash
  PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 864
  2⤵
  - Program crash
  PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 700
  2⤵
  - Program crash
  PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1016
  2⤵
  - Program crash
  PID:4896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 852
  2⤵
  - Program crash
  PID:288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 996
  2⤵
  - Program crash
  PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 932
  2⤵
  - Program crash
  PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 908
  2⤵
  - Program crash
  PID:4132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1020
  2⤵
  - Program crash
  PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 920
  2⤵
  - Program crash
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 868
  2⤵
  - Program crash
  PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 960
  2⤵
  - Program crash
  PID:3416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 700
  2⤵
  - Program crash
  PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 672
  2⤵
  - Program crash
  PID:4544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 724
  2⤵
  - Program crash
  PID:4008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 752
  2⤵
  - Program crash
  PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1020
  2⤵
  - Program crash
  PID:5036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1000
  2⤵
  - Program crash
  PID:4948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 680
  2⤵
  - Program crash
  PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 876
  2⤵
  - Program crash
  PID:4840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 992
  2⤵
  - Program crash
  PID:100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 776
  2⤵
  - Program crash
  PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 680
  2⤵
  - Program crash
  PID:3560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1016
  2⤵
  - Program crash
  PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1020
  2⤵
  - Program crash
  PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 736
  2⤵
  - Program crash
  PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 680
  2⤵
  - Program crash
  PID:908
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:2936
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 780
  2⤵
  - Program crash
  PID:4572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1088
  2⤵
  - Program crash
  PID:3532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1172
  2⤵
  - Program crash
  PID:3696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1212
  2⤵
  - Program crash
  PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1104
  2⤵
  - Program crash
  PID:1372
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:3384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1300
  2⤵
  - Program crash
  PID:3648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1484
  2⤵
  - Program crash
  PID:2008
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1520
  2⤵
  - Program crash
  PID:4876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1356
  2⤵
  - Program crash
  PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4636 -ip 4636
1⤵
PID:1976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4636 -ip 4636
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4636 -ip 4636
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4636 -ip 4636
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4636 -ip 4636
1⤵
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4636 -ip 4636
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4636 -ip 4636
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4636 -ip 4636
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4636 -ip 4636
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4636 -ip 4636
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4636 -ip 4636
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4636 -ip 4636
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4636 -ip 4636
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4636 -ip 4636
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4636 -ip 4636
1⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4636 -ip 4636
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4636 -ip 4636
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4636 -ip 4636
1⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4636 -ip 4636
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4636 -ip 4636
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4636 -ip 4636
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4636 -ip 4636
1⤵
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4636 -ip 4636
1⤵
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4636 -ip 4636
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4636 -ip 4636
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4636 -ip 4636
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4636 -ip 4636
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4636 -ip 4636
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4636 -ip 4636
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4636 -ip 4636
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4636 -ip 4636
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4636 -ip 4636
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4636 -ip 4636
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4636 -ip 4636
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4636 -ip 4636
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4636 -ip 4636
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4636 -ip 4636
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4636 -ip 4636
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4636 -ip 4636
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4636 -ip 4636
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4636 -ip 4636
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4636 -ip 4636
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4636 -ip 4636
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 4636 -ip 4636
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4636 -ip 4636
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4636 -ip 4636
1⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4636 -ip 4636
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4636 -ip 4636
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4636 -ip 4636
1⤵
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4636 -ip 4636
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4636 -ip 4636
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4636 -ip 4636
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 4636 -ip 4636
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4636 -ip 4636
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4636 -ip 4636
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4636 -ip 4636
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 4636 -ip 4636
1⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 4636 -ip 4636
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 4636 -ip 4636
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4636 -ip 4636
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4636 -ip 4636
1⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 4636 -ip 4636
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4636 -ip 4636
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
594a6579141e27b7754fcd9f683e5482

SHA1
4dd49d39da7693d19183e84b235541b07e7dba4a

SHA256
08284de55d0dc5c616538f4431eadbdd288177ddff0847ee5d939ecaeeb3797c

SHA512
ce8a401b32668c7eb60cc3272f1456b0d262d9e81376cb5e4875ce18860db8ea74e95b087433ea46783f809ee6a5e68c9e64d698765bff10d88f2532a9feddc1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
594a6579141e27b7754fcd9f683e5482

SHA1
4dd49d39da7693d19183e84b235541b07e7dba4a

SHA256
08284de55d0dc5c616538f4431eadbdd288177ddff0847ee5d939ecaeeb3797c

SHA512
ce8a401b32668c7eb60cc3272f1456b0d262d9e81376cb5e4875ce18860db8ea74e95b087433ea46783f809ee6a5e68c9e64d698765bff10d88f2532a9feddc1

Download Submit
memory/1364-143-0x0000000000000000-mapping.dmp

Download
memory/1416-131-0x0000000000000000-mapping.dmp

Download
memory/1828-133-0x0000000000000000-mapping.dmp

Download
memory/1904-139-0x0000000000000000-mapping.dmp

Download
memory/2936-138-0x0000000000000000-mapping.dmp

Download
memory/3384-140-0x0000000000000000-mapping.dmp

Download
memory/3484-132-0x0000000000000000-mapping.dmp

Download
memory/4636-136-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4636-130-0x00000000005AF000-0x00000000005C2000-memory.dmp

Filesize
76KB

Download
memory/4636-135-0x00000000004F0000-0x0000000000509000-memory.dmp

Filesize
100KB

Download
memory/4636-134-0x00000000005AF000-0x00000000005C2000-memory.dmp

Filesize
76KB

Download
memory/4660-137-0x0000000000000000-mapping.dmp

Download