Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
13-01-2023 10:57
Static task
static1
Behavioral task
behavioral1
Sample
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe
Resource
win10v2004-20220901-en
General
-
Target
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe
-
Size
92KB
-
MD5
a6de0d47bb017e59aefec6f4b00c2157
-
SHA1
a71fe7dc24be53aac39771bcddaa4654fca2a26a
-
SHA256
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0
-
SHA512
46ebbe73f247b6c2ef48199bf475cbb8dc4631e8821ba2c630a2628322e8e59c54ce5c69ba68bbf173e9c31d8ce18ed96f62641f3a075bcba4ccd00b7d6f2c61
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AbCmeVhPe34Lk7nUr23mwDl:Qw+asqN5aW/hLlO3Lk7Ur23bl
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
ronrivest@airmail.cc
ronrivest@tuta.io
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe = "C:\\Windows\\System32\\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe" 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PB7XGXUS\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TQU6SHT\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Music\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YB33FE3E\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\60C94KT8\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Drops file in System32 directory 2 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File created C:\Windows\System32\Info.hta 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Windows\System32\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR46B.GIF.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EET.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44B.GIF 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\ICE.ELM 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\youtube.crx 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Araguaina 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\gu.pak.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\ja-JP\Sidebar.exe.mui 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ReviewRouting_Review.xsn.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\STSUCRES.DLL.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\ISO690Nmerical.XSL 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER32.DLL.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\gadget.xml 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101865.BMP 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18250_.WMF.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hiring Requisition.fdt.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OUTGOING.ICO 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00513_.WMF.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03731_.WMF 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Technic.eftx.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\MSGR3FR.DLL.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImagesMask.bmp.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL022.XML.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148798.JPG.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\EDGE.INF.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXT.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\APPTS.ICO.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\TimeCard.xltx.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099152.JPG.id-3F71244F.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 668 vssadmin.exe 1720 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exepid process 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1528 vssvc.exe Token: SeRestorePrivilege 1528 vssvc.exe Token: SeAuditPrivilege 1528 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.execmd.execmd.exedescription pid process target process PID 1112 wrote to memory of 1788 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1112 wrote to memory of 1788 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1112 wrote to memory of 1788 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1112 wrote to memory of 1788 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1788 wrote to memory of 1768 1788 cmd.exe mode.com PID 1788 wrote to memory of 1768 1788 cmd.exe mode.com PID 1788 wrote to memory of 1768 1788 cmd.exe mode.com PID 1788 wrote to memory of 668 1788 cmd.exe vssadmin.exe PID 1788 wrote to memory of 668 1788 cmd.exe vssadmin.exe PID 1788 wrote to memory of 668 1788 cmd.exe vssadmin.exe PID 1112 wrote to memory of 1056 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1112 wrote to memory of 1056 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1112 wrote to memory of 1056 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1112 wrote to memory of 1056 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1056 wrote to memory of 1244 1056 cmd.exe mode.com PID 1056 wrote to memory of 1244 1056 cmd.exe mode.com PID 1056 wrote to memory of 1244 1056 cmd.exe mode.com PID 1056 wrote to memory of 1720 1056 cmd.exe vssadmin.exe PID 1056 wrote to memory of 1720 1056 cmd.exe vssadmin.exe PID 1056 wrote to memory of 1720 1056 cmd.exe vssadmin.exe PID 1112 wrote to memory of 932 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 1112 wrote to memory of 932 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 1112 wrote to memory of 932 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 1112 wrote to memory of 932 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 1112 wrote to memory of 1500 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 1112 wrote to memory of 1500 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 1112 wrote to memory of 1500 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 1112 wrote to memory of 1500 1112 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe"C:\Users\Admin\AppData\Local\Temp\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
4KB
MD54905383fd14a58c7ef874fc09d87c041
SHA12e2c5b60d589941a1748108ef3c8acab572ce4b4
SHA2567d87480a55c33f2fa5abcfbafc1045fa1483f80247cd1605d8e3b7d77883d521
SHA512622738c8a64f63fad815303ce8fa40ce372b9da472934a556e8c450984a73724d1afd9a75134a5a9a7a5b59c6eb522d5761df7770ab91665c94d3b26fedeb183
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
4KB
MD54905383fd14a58c7ef874fc09d87c041
SHA12e2c5b60d589941a1748108ef3c8acab572ce4b4
SHA2567d87480a55c33f2fa5abcfbafc1045fa1483f80247cd1605d8e3b7d77883d521
SHA512622738c8a64f63fad815303ce8fa40ce372b9da472934a556e8c450984a73724d1afd9a75134a5a9a7a5b59c6eb522d5761df7770ab91665c94d3b26fedeb183
-
memory/668-57-0x0000000000000000-mapping.dmp
-
memory/932-63-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmpFilesize
8KB
-
memory/932-61-0x0000000000000000-mapping.dmp
-
memory/932-83-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmpFilesize
64KB
-
memory/1056-58-0x0000000000000000-mapping.dmp
-
memory/1112-54-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/1244-59-0x0000000000000000-mapping.dmp
-
memory/1500-62-0x0000000000000000-mapping.dmp
-
memory/1720-60-0x0000000000000000-mapping.dmp
-
memory/1768-56-0x0000000000000000-mapping.dmp
-
memory/1788-55-0x0000000000000000-mapping.dmp