Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-12-2022 14:36
Static task
static1
Behavioral task
behavioral1
Sample
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe
Resource
win10v2004-20221111-en
General
-
Target
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe
-
Size
702KB
-
MD5
21d82a5c9d977f7c5c5015829c321a13
-
SHA1
ffb493214fd5ac83f2a628bc0e15f5a060c36ffc
-
SHA256
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba
-
SHA512
91e5480b1e9d329c411f62c4eb99bfeda6161e07cb238acf3b00073e4d6cdadc9c1d6859561a5135833f585b5026228b063ab3aff81ff04f9534c31b08a99c34
-
SSDEEP
12288:5IODa1GPYOBsDMOUaIQpGyEV3T5W241YgNxMmDsbiYltjHR7r4w9QvbfsZ6jlPm5:5IO+aYxHjpYT5s1YgNxMmDsbiYltjHRj
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@stex777.com
admin@stex777.xyz
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\GrantRequest.tiff 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe -
Drops startup file 5 IoCs
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe = "C:\\Windows\\System32\\30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe" 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Documents\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\UN1Y26T5\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\COPX4L9J\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Music\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Links\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z0VF2WDD\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\C2EPRMM6\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Videos\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\WZHASH05\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe -
Drops file in System32 directory 2 IoCs
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exedescription ioc process File created C:\Windows\System32\Info.hta 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Windows\System32\30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exedescription pid process target process PID 1528 set thread context of 964 1528 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe -
Drops file in Program Files directory 64 IoCs
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exedescription ioc process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\SessionOwner.ico.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.RunTime.Serialization.Resources.dll 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746G.GIF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0287005.WMF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14980_.GIF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.bfc 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABON.JPG.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382938.JPG.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jre7\bin\sunec.dll 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00397_.WMF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02267_.WMF 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files\7-Zip\Lang\mk.txt.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpClient.dll 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jre7\lib\resources.jar.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239965.WMF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.XML.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous.png 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1A.BDR 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ml.pak.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382942.JPG 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\VideoLAN\VLC\libvlc.dll 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\BUTTON.GIF 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.msi.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down_BIDI.png 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ENVELOPR.DLL.IDX_DLL.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RE00006_.WMF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00345_.WMF.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PPINTL.DLL.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.DPV.id-20A73494.[admin@stex777.com].money 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1804 vssadmin.exe 1608 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exepid process 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1224 vssvc.exe Token: SeRestorePrivilege 1224 vssvc.exe Token: SeAuditPrivilege 1224 vssvc.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.execmd.execmd.exedescription pid process target process PID 1528 wrote to memory of 964 1528 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe PID 1528 wrote to memory of 964 1528 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe PID 1528 wrote to memory of 964 1528 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe PID 1528 wrote to memory of 964 1528 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe PID 1528 wrote to memory of 964 1528 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe PID 964 wrote to memory of 2024 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe cmd.exe PID 964 wrote to memory of 2024 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe cmd.exe PID 964 wrote to memory of 2024 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe cmd.exe PID 964 wrote to memory of 2024 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe cmd.exe PID 2024 wrote to memory of 1976 2024 cmd.exe mode.com PID 2024 wrote to memory of 1976 2024 cmd.exe mode.com PID 2024 wrote to memory of 1976 2024 cmd.exe mode.com PID 2024 wrote to memory of 1804 2024 cmd.exe vssadmin.exe PID 2024 wrote to memory of 1804 2024 cmd.exe vssadmin.exe PID 2024 wrote to memory of 1804 2024 cmd.exe vssadmin.exe PID 964 wrote to memory of 1536 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe cmd.exe PID 964 wrote to memory of 1536 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe cmd.exe PID 964 wrote to memory of 1536 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe cmd.exe PID 964 wrote to memory of 1536 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe cmd.exe PID 1536 wrote to memory of 1816 1536 cmd.exe mode.com PID 1536 wrote to memory of 1816 1536 cmd.exe mode.com PID 1536 wrote to memory of 1816 1536 cmd.exe mode.com PID 1536 wrote to memory of 1608 1536 cmd.exe vssadmin.exe PID 1536 wrote to memory of 1608 1536 cmd.exe vssadmin.exe PID 1536 wrote to memory of 1608 1536 cmd.exe vssadmin.exe PID 964 wrote to memory of 1220 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe mshta.exe PID 964 wrote to memory of 1220 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe mshta.exe PID 964 wrote to memory of 1220 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe mshta.exe PID 964 wrote to memory of 1220 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe mshta.exe PID 964 wrote to memory of 1092 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe mshta.exe PID 964 wrote to memory of 1092 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe mshta.exe PID 964 wrote to memory of 1092 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe mshta.exe PID 964 wrote to memory of 1092 964 30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe"C:\Users\Admin\AppData\Local\Temp\30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exeC:\Users\Admin\AppData\Local\Temp\30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe2⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5316a4b3076599a38ef2a03735b192202
SHA1707efccc2fc62ecd73a8d079ba042b2e15429c13
SHA2565090b4b826ef35494d10320d6f7127da45d4c49ad37b7cc228a41e9a77805829
SHA512c1e42d29c133b682ad52e3c08849e4f0ebbe2badec7870812ee277798a1b48264b1111b16b7ac93c2bb83194801aa47d93dbd1c8d89886101874345ea489cb25
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5316a4b3076599a38ef2a03735b192202
SHA1707efccc2fc62ecd73a8d079ba042b2e15429c13
SHA2565090b4b826ef35494d10320d6f7127da45d4c49ad37b7cc228a41e9a77805829
SHA512c1e42d29c133b682ad52e3c08849e4f0ebbe2badec7870812ee277798a1b48264b1111b16b7ac93c2bb83194801aa47d93dbd1c8d89886101874345ea489cb25
-
memory/964-56-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/964-61-0x000000000040A9D0-mapping.dmp
-
memory/964-62-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1092-71-0x0000000000000000-mapping.dmp
-
memory/1220-70-0x0000000000000000-mapping.dmp
-
memory/1220-72-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmpFilesize
8KB
-
memory/1528-54-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1528-55-0x0000000002850000-0x0000000002883000-memory.dmpFilesize
204KB
-
memory/1536-67-0x0000000000000000-mapping.dmp
-
memory/1608-69-0x0000000000000000-mapping.dmp
-
memory/1804-66-0x0000000000000000-mapping.dmp
-
memory/1816-68-0x0000000000000000-mapping.dmp
-
memory/1976-65-0x0000000000000000-mapping.dmp
-
memory/2024-64-0x0000000000000000-mapping.dmp