Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:54
Static task
static1
Behavioral task
behavioral1
Sample
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe
Resource
win10v2004-20220901-en
General
-
Target
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe
-
Size
271KB
-
MD5
c52198dd4ec25b0eea665e6e0a8d4dd7
-
SHA1
2ead1a996c1a63be93e91587103320bca38561ae
-
SHA256
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020
-
SHA512
3a6426a5e42723cb9c0153d8893e8f23694868d9905fe7945dfa245ec6e879770abf30fb5a3767a9c457627a80a90f3bd8d7c1cc65a127c42e61517d9e201d1f
-
SSDEEP
6144:z9os9pGaytIcctkrCOEKc9YBsq0tm/6zf5PYF+AHW4p+fBry+aVze2U:z9os9pGaQI76GhKcysfQSzRPYcAHt+uk
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
pexdatax@gmail.com
https://tox.chat/download.html
http://pexdatax.com/
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe -
Drops startup file 5 IoCs
Processes:
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe = "C:\\Windows\\System32\\624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe" 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exedescription ioc process File opened for modification C:\Program Files\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Links\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Public\Documents\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Public\Videos\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files (x86)\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Public\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Music\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Users\Public\Music\desktop.ini 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe -
Drops file in System32 directory 2 IoCs
Processes:
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exedescription ioc process File created C:\Windows\System32\624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Windows\System32\Info.hta 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe -
Drops file in Program Files directory 64 IoCs
Processes:
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-hover_32.svg.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\7-Zip\Lang\ug.txt.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-100_contrast-black.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-400.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-40.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ui-strings.js.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\LargeTile.scale-125.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-48.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\JPEGIM32.FLT 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\JumpListNewNote.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-white_scale-100.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\7-Zip\Lang\tt.txt.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\net.dll 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\orcl7.xsl.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\THMBNAIL.PNG 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\RECOVR32.CNV.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-fullcolor.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\ui-strings.js 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\accessibility.properties.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\ui-strings.js.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ui-strings.js.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\ui-strings.js.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\cursors.properties.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_2x.png.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-125.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\MountOpen.easmx 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-100_contrast-white.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Mozilla Firefox\IA2Marshal.dll 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ru.pak.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\t2k.dll.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.id-A350B1A8.[pexdatax@gmail.com].ROGER 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\MSSOAPR3.DLL 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.dll 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2156 vssadmin.exe 732 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exepid process 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 5024 vssvc.exe Token: SeRestorePrivilege 5024 vssvc.exe Token: SeAuditPrivilege 5024 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.execmd.execmd.exedescription pid process target process PID 4864 wrote to memory of 4888 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe cmd.exe PID 4864 wrote to memory of 4888 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe cmd.exe PID 4888 wrote to memory of 2548 4888 cmd.exe mode.com PID 4888 wrote to memory of 2548 4888 cmd.exe mode.com PID 4888 wrote to memory of 2156 4888 cmd.exe vssadmin.exe PID 4888 wrote to memory of 2156 4888 cmd.exe vssadmin.exe PID 4864 wrote to memory of 2332 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe cmd.exe PID 4864 wrote to memory of 2332 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe cmd.exe PID 2332 wrote to memory of 676 2332 cmd.exe mode.com PID 2332 wrote to memory of 676 2332 cmd.exe mode.com PID 2332 wrote to memory of 732 2332 cmd.exe vssadmin.exe PID 2332 wrote to memory of 732 2332 cmd.exe vssadmin.exe PID 4864 wrote to memory of 1924 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe mshta.exe PID 4864 wrote to memory of 1924 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe mshta.exe PID 4864 wrote to memory of 2384 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe mshta.exe PID 4864 wrote to memory of 2384 4864 624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe"C:\Users\Admin\AppData\Local\Temp\624fc9dbcf5f1c92ee34202ce1ecad6f139b816d471531b6ea062da798652020.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5c5d2eed4eb50c26a0704ab4af5d2f653
SHA14fbc07e3470b06c815897b5bfbd60e04794adf93
SHA256df3f9f97013a6f2f01b1dc669bec27d471b0ad4954d8f8d388caef044129201e
SHA5122cc70d6da3bff02aa98a98098c92c9a8789669baf7210b88bcd7d8b93817ea3f257d53117a85ae1e93e6c2215774f7623e5e324499b1b9349636fc129100963c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5c5d2eed4eb50c26a0704ab4af5d2f653
SHA14fbc07e3470b06c815897b5bfbd60e04794adf93
SHA256df3f9f97013a6f2f01b1dc669bec27d471b0ad4954d8f8d388caef044129201e
SHA5122cc70d6da3bff02aa98a98098c92c9a8789669baf7210b88bcd7d8b93817ea3f257d53117a85ae1e93e6c2215774f7623e5e324499b1b9349636fc129100963c
-
memory/676-142-0x0000000000000000-mapping.dmp
-
memory/732-143-0x0000000000000000-mapping.dmp
-
memory/1924-144-0x0000000000000000-mapping.dmp
-
memory/2156-137-0x0000000000000000-mapping.dmp
-
memory/2332-141-0x0000000000000000-mapping.dmp
-
memory/2384-145-0x0000000000000000-mapping.dmp
-
memory/2548-136-0x0000000000000000-mapping.dmp
-
memory/4864-140-0x0000000000400000-0x00000000008D3000-memory.dmpFilesize
4.8MB
-
memory/4864-139-0x00000000001C0000-0x00000000001D9000-memory.dmpFilesize
100KB
-
memory/4864-138-0x0000000000AB2000-0x0000000000AC5000-memory.dmpFilesize
76KB
-
memory/4864-132-0x0000000000AB2000-0x0000000000AC5000-memory.dmpFilesize
76KB
-
memory/4864-135-0x0000000000400000-0x00000000008D3000-memory.dmpFilesize
4.8MB
-
memory/4864-133-0x00000000001C0000-0x00000000001D9000-memory.dmpFilesize
100KB
-
memory/4888-134-0x0000000000000000-mapping.dmp