dharma | d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191

Analysis

max time kernel
152s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
Size

304KB
MD5

19e48e72c51e0e652a2b5c75db0ef9bc
SHA1

b4ea00205b0e611e2fc155d5ded19b22cd6341f3
SHA256

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191
SHA512

65269d693b7ddf70c76069d2a80cec73ba1f78a38b0cfcf029af5c30eca972a7b2f21c327f63ac5a17d85a7fab4008e4c04d6ba4e50561f2f71ea7ede52175e2

Score

10^/10

dharma persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe = "C:\\Windows\\System32\\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe"	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3463845317-933582289-45817732-1000\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\desktop.ini	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Drops file in System32 directory 1 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
File created	C:\Windows\System32\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Drops file in Program Files directory 64 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfig.xml	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-black_scale-125.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200_contrast-high.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_contrast-black.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\cursors.properties.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-io.xml	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\fontmanager.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-400_contrast-white.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected].[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\PingRemove.pptx.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_fr.properties.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\PREVIEW.GIF.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\WideTile.scale-125.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-24_altform-lightunplated.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\de.pak.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MediumTile.scale-100_contrast-black.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\AssertResolve.001	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-dark\Settings.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageLargeTile.scale-100.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\vi.pak.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-256_altform-unplated.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-125.png	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.id-B87EF218.[[email protected]].money	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Program crash 42 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4260	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2256	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4892	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4968	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
792	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1120	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2316	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4016	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4532	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2736	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2056	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3668	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3800	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4160	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3748	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4564	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2688	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4332	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
332	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3000	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4364	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
732	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2748	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3992	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4552	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2340	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
220	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4176	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
5036	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4292	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2216	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1000	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4900	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3932	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
3832	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
748	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
2508	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
264	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4040	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4492	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1700	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
4996	1256	WerFault.exe	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1172 vssadmin.exe

pid	process
1172	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

pid	process
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 3860 vssvc.exe
Token: SeRestorePrivilege 3860 vssvc.exe
Token: SeAuditPrivilege 3860 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	3860	vssvc.exe
Token: SeRestorePrivilege	3860	vssvc.exe
Token: SeAuditPrivilege	3860	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.execmd.exe

description	pid	process	target process
PID 1256 wrote to memory of 460	1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	cmd.exe
PID 1256 wrote to memory of 460	1256	d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe	cmd.exe
PID 460 wrote to memory of 1752	460	cmd.exe	mode.com
PID 460 wrote to memory of 1752	460	cmd.exe	mode.com
PID 460 wrote to memory of 1172	460	cmd.exe	vssadmin.exe
PID 460 wrote to memory of 1172	460	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe
"C:\Users\Admin\AppData\Local\Temp\d4d53c64cb46b4a286bdfdecaa928ed77942d8838506356bfbb6b8da8349c191.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:1752
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 524
  2⤵
  - Program crash
  PID:4260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 540
  2⤵
  - Program crash
  PID:2256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 532
  2⤵
  - Program crash
  PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 604
  2⤵
  - Program crash
  PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 644
  2⤵
  - Program crash
  PID:792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 668
  2⤵
  - Program crash
  PID:1120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 532
  2⤵
  - Program crash
  PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 608
  2⤵
  - Program crash
  PID:4016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 524
  2⤵
  - Program crash
  PID:4532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 608
  2⤵
  - Program crash
  PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 576
  2⤵
  - Program crash
  PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 772
  2⤵
  - Program crash
  PID:3668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 780
  2⤵
  - Program crash
  PID:3800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 808
  2⤵
  - Program crash
  PID:4160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 816
  2⤵
  - Program crash
  PID:3748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 824
  2⤵
  - Program crash
  PID:4564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 780
  2⤵
  - Program crash
  PID:2688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 860
  2⤵
  - Program crash
  PID:4332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 784
  2⤵
  - Program crash
  PID:332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 856
  2⤵
  - Program crash
  PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 776
  2⤵
  - Program crash
  PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 896
  2⤵
  - Program crash
  PID:732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 740
  2⤵
  - Program crash
  PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 896
  2⤵
  - Program crash
  PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 888
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 840
  2⤵
  - Program crash
  PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 968
  2⤵
  - Program crash
  PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 988
  2⤵
  - Program crash
  PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 928
  2⤵
  - Program crash
  PID:5036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 1004
  2⤵
  - Program crash
  PID:4292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 976
  2⤵
  - Program crash
  PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 952
  2⤵
  - Program crash
  PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 920
  2⤵
  - Program crash
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 628
  2⤵
  - Program crash
  PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 808
  2⤵
  - Program crash
  PID:3832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 932
  2⤵
  - Program crash
  PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 1016
  2⤵
  - Program crash
  PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 888
  2⤵
  - Program crash
  PID:264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 912
  2⤵
  - Program crash
  PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 880
  2⤵
  - Program crash
  PID:4492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 712
  2⤵
  - Program crash
  PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 628
  2⤵
  - Program crash
  PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1256 -ip 1256
1⤵
PID:1700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1256 -ip 1256
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1256 -ip 1256
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1256 -ip 1256
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1256 -ip 1256
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1256 -ip 1256
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1256 -ip 1256
1⤵
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1256 -ip 1256
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1256 -ip 1256
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1256 -ip 1256
1⤵
PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1256 -ip 1256
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1256 -ip 1256
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1256 -ip 1256
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1256 -ip 1256
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1256 -ip 1256
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1256 -ip 1256
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1256 -ip 1256
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1256 -ip 1256
1⤵
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1256 -ip 1256
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1256 -ip 1256
1⤵
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1256 -ip 1256
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1256 -ip 1256
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1256 -ip 1256
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1256 -ip 1256
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1256 -ip 1256
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1256 -ip 1256
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1256 -ip 1256
1⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1256 -ip 1256
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1256 -ip 1256
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1256 -ip 1256
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1256 -ip 1256
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1256 -ip 1256
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1256 -ip 1256
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1256 -ip 1256
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1256 -ip 1256
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1256 -ip 1256
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1256 -ip 1256
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1256 -ip 1256
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1256 -ip 1256
1⤵
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1256 -ip 1256
1⤵
PID:296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1256 -ip 1256
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1256 -ip 1256
1⤵
PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1256 -ip 1256
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/460-136-0x0000000000000000-mapping.dmp

Download
memory/1172-138-0x0000000000000000-mapping.dmp

Download
memory/1256-132-0x0000000000884000-0x0000000000899000-memory.dmp

Filesize
84KB

Download
memory/1256-133-0x0000000000884000-0x0000000000899000-memory.dmp

Filesize
84KB

Download
memory/1256-134-0x0000000000790000-0x00000000007A9000-memory.dmp

Filesize
100KB

Download
memory/1256-135-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1256-139-0x0000000000790000-0x00000000007A9000-memory.dmp

Filesize
100KB

Download
memory/1256-140-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/1752-137-0x0000000000000000-mapping.dmp

Download