Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2023 10:57
Static task
static1
Behavioral task
behavioral1
Sample
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe
Resource
win10v2004-20220901-en
General
-
Target
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe
-
Size
92KB
-
MD5
a6de0d47bb017e59aefec6f4b00c2157
-
SHA1
a71fe7dc24be53aac39771bcddaa4654fca2a26a
-
SHA256
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0
-
SHA512
46ebbe73f247b6c2ef48199bf475cbb8dc4631e8821ba2c630a2628322e8e59c54ce5c69ba68bbf173e9c31d8ce18ed96f62641f3a075bcba4ccd00b7d6f2c61
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AbCmeVhPe34Lk7nUr23mwDl:Qw+asqN5aW/hLlO3Lk7Ur23bl
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
ronrivest@airmail.cc
ronrivest@tuta.io
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\InstallPing.tiff 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Drops startup file 5 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe = "C:\\Windows\\System32\\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe" 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File opened for modification C:\Users\Admin\OneDrive\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Music\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Music\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Drops file in System32 directory 2 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File created C:\Windows\System32\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Windows\System32\Info.hta 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfxswt.jar 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutArchiveImage.layoutdir-RTL.gif 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses_selected.svg.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookAccount.scale-100.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\back-icon@4x.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot_2x.png.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\print_poster.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\ui-strings.js.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\ui-strings.js 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-40_altform-unplated.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxLargeTile.scale-200.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-40_altform-unplated_contrast-white.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Vbe.Interop.dll.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-30_altform-unplated_contrast-black.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\List.txt.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\hprof.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-125_contrast-white.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.167.21\msedgeupdateres_or.dll.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ja.pak 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-150.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-100.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-30.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ind_prog.gif 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MINSBPROXY.DLL.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\psfont.properties.ja 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\SmallTile.scale-100_contrast-white.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\SmallTile.scale-100.png 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Microsoft.Graphics.Canvas.winmd 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwgst.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\msvcr120.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview-hover.svg.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\msointlimm.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jsound.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.id-6D580BEC.[cybercrypt@tutanota.com].CY3 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1492 vssadmin.exe 2424 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exepid process 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2332 vssvc.exe Token: SeRestorePrivilege 2332 vssvc.exe Token: SeAuditPrivilege 2332 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.execmd.execmd.exedescription pid process target process PID 5036 wrote to memory of 2536 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 5036 wrote to memory of 2536 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 2536 wrote to memory of 3620 2536 cmd.exe mode.com PID 2536 wrote to memory of 3620 2536 cmd.exe mode.com PID 2536 wrote to memory of 1492 2536 cmd.exe vssadmin.exe PID 2536 wrote to memory of 1492 2536 cmd.exe vssadmin.exe PID 5036 wrote to memory of 1256 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 5036 wrote to memory of 1256 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe cmd.exe PID 1256 wrote to memory of 3116 1256 cmd.exe mode.com PID 1256 wrote to memory of 3116 1256 cmd.exe mode.com PID 1256 wrote to memory of 2424 1256 cmd.exe vssadmin.exe PID 1256 wrote to memory of 2424 1256 cmd.exe vssadmin.exe PID 5036 wrote to memory of 5004 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 5036 wrote to memory of 5004 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 5036 wrote to memory of 1796 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe PID 5036 wrote to memory of 1796 5036 5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe"C:\Users\Admin\AppData\Local\Temp\5c2fb1c42f007093be5e463f70ee7e7192990b3385a3cbcc71043980efa312e0.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
4KB
MD5f78cc9e05d01536c748ec407ce9ee048
SHA18efb3806c7cf7cdca6921e747a918169c3077163
SHA256bc68f558a15362e04d82e88c03e064d9bb2df8a48c298effa4efe4d270b09d81
SHA512efa1956591f768005f8b6dfc5b194379158e302b5a6fb8216867659d1f0befadbd796150291370b807a479207995f6fab88b5839ea3e17ecf053cedaa504c499
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
4KB
MD5f78cc9e05d01536c748ec407ce9ee048
SHA18efb3806c7cf7cdca6921e747a918169c3077163
SHA256bc68f558a15362e04d82e88c03e064d9bb2df8a48c298effa4efe4d270b09d81
SHA512efa1956591f768005f8b6dfc5b194379158e302b5a6fb8216867659d1f0befadbd796150291370b807a479207995f6fab88b5839ea3e17ecf053cedaa504c499
-
memory/1256-135-0x0000000000000000-mapping.dmp
-
memory/1492-134-0x0000000000000000-mapping.dmp
-
memory/1796-139-0x0000000000000000-mapping.dmp
-
memory/2424-137-0x0000000000000000-mapping.dmp
-
memory/2536-132-0x0000000000000000-mapping.dmp
-
memory/3116-136-0x0000000000000000-mapping.dmp
-
memory/3620-133-0x0000000000000000-mapping.dmp
-
memory/5004-138-0x0000000000000000-mapping.dmp