dharma | 6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811

General

Target

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
Size

92KB
MD5

9220abc8a4ead7e58bc51c54d1c8343b
SHA1

9a9c96e8d20137c0fc05e47a51f4b05383c9b08d
SHA256

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811
SHA512

e139809bf7f69adf3af6a61101752e3b5ca46fcd125230b6eef7b8a10b15dce8f42d31cdadbca3f27eb25681978aa7d81e04c76ea827b67af6df361c777a1768
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4AkVPzt8y0huqDUbubf4QJX/HthECaj6:Qw+asqN5aW/hLuJzbsuqDJ4QJ/to

Score

10^/10

dharma persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! Don't worry, you can return all your files! If you want to restore them, write to the mail: buhelper@proton.me : dong@techmail.info YOUR ID dong@airmail.cc Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

buhelper@proton.me

dong@techmail.info

dong@airmail.cc

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RequestFind.tiff	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Pictures\WaitRestore.tiff	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Pictures\DismountUpdate.tiff	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

Drops startup file 5 IoCs

Processes:

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe = "C:\\Windows\\System32\\6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe"	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\31F8NSAV\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FIOPHPFJ\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\P35Q2WMD\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O0UAU3O6\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\UIFY0MN9\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\9W0XRO68\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1FJGZ2IT\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

Drops file in System32 directory 2 IoCs

Processes:

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

description	ioc	process
File created	C:\Windows\System32\6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Windows\System32\Info.hta	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

Drops file in Program Files directory 64 IoCs

Processes:

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICCAP98.POC.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_sl.dll	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01065_.WMF	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00413_.WMF.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\THMBNAIL.PNG	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382947.JPG	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Engine.resources.dll	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB02229_.GIF.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN108.XML.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SOCIALCONNECTORRES.DLL.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ContactSelector.ico.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PICTIM32.FLT	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis.css.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0217698.WMF	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Jamaica	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0290548.WMF.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18207_.WMF.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXEV.DLL.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\validation.js	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\XLINTL32.DLL.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\SLATE.INF	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_hi.dll	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyResume.dotx.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\formautofill@mozilla.org.xpi	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1A.BDR.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DOTS.POC.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292286.WMF.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFNOT.ICO	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\THMBNAIL.PNG.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan.id-4B5B80E4.[dong@techmail.info].d0n	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00299_.WMF	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1804 vssadmin.exe
744 vssadmin.exe

pid	process
1804	vssadmin.exe
744	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

pid	process
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1012 vssvc.exe
Token: SeRestorePrivilege 1012 vssvc.exe
Token: SeAuditPrivilege 1012 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1012	vssvc.exe
Token: SeRestorePrivilege	1012	vssvc.exe
Token: SeAuditPrivilege	1012	vssvc.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.execmd.execmd.exe

description	pid	process	target process
PID 1444 wrote to memory of 532	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	cmd.exe
PID 1444 wrote to memory of 532	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	cmd.exe
PID 1444 wrote to memory of 532	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	cmd.exe
PID 1444 wrote to memory of 532	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	cmd.exe
PID 532 wrote to memory of 1116	532	cmd.exe	mode.com
PID 532 wrote to memory of 1116	532	cmd.exe	mode.com
PID 532 wrote to memory of 1116	532	cmd.exe	mode.com
PID 532 wrote to memory of 1804	532	cmd.exe	vssadmin.exe
PID 532 wrote to memory of 1804	532	cmd.exe	vssadmin.exe
PID 532 wrote to memory of 1804	532	cmd.exe	vssadmin.exe
PID 1444 wrote to memory of 760	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	cmd.exe
PID 1444 wrote to memory of 760	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	cmd.exe
PID 1444 wrote to memory of 760	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	cmd.exe
PID 1444 wrote to memory of 760	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	cmd.exe
PID 760 wrote to memory of 656	760	cmd.exe	mode.com
PID 760 wrote to memory of 656	760	cmd.exe	mode.com
PID 760 wrote to memory of 656	760	cmd.exe	mode.com
PID 760 wrote to memory of 744	760	cmd.exe	vssadmin.exe
PID 760 wrote to memory of 744	760	cmd.exe	vssadmin.exe
PID 760 wrote to memory of 744	760	cmd.exe	vssadmin.exe
PID 1444 wrote to memory of 1780	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	mshta.exe
PID 1444 wrote to memory of 1780	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	mshta.exe
PID 1444 wrote to memory of 1780	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	mshta.exe
PID 1444 wrote to memory of 1780	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	mshta.exe
PID 1444 wrote to memory of 752	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	mshta.exe
PID 1444 wrote to memory of 752	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	mshta.exe
PID 1444 wrote to memory of 752	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	mshta.exe
PID 1444 wrote to memory of 752	1444	6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe
"C:\Users\Admin\AppData\Local\Temp\6a0017262def9565b504d04318c59f55bea136ac3dd48862d1ae90ff6b963811.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:1116

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1804

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:656

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:744

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
- Modifies Internet Explorer settings
PID:1780

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
- Modifies Internet Explorer settings
PID:752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Filesize
4KB

MD5
48b3b05a7316ca1eb41db19ee6fb8b4f

SHA1
948b3b1f0a34bfa601e316965426cdd569f85afb

SHA256
362186975f489cd6c85c59b083bc0f45f05d22b58f02cdc308d3a98691652953

SHA512
3a888eef37df34c77cc823cf7ba778081c8db5c356acdd4d82626783ef42f3e4ae8481c6fb99b6b6b1628ad6844d4defa1a9d93259a372680ed45722ce4dda8f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Filesize
4KB

MD5
48b3b05a7316ca1eb41db19ee6fb8b4f

SHA1
948b3b1f0a34bfa601e316965426cdd569f85afb

SHA256
362186975f489cd6c85c59b083bc0f45f05d22b58f02cdc308d3a98691652953

SHA512
3a888eef37df34c77cc823cf7ba778081c8db5c356acdd4d82626783ef42f3e4ae8481c6fb99b6b6b1628ad6844d4defa1a9d93259a372680ed45722ce4dda8f

Download Submit
memory/532-55-0x0000000000000000-mapping.dmp

Download
memory/656-59-0x0000000000000000-mapping.dmp

Download
memory/744-60-0x0000000000000000-mapping.dmp

Download
memory/752-62-0x0000000000000000-mapping.dmp

Download
memory/760-58-0x0000000000000000-mapping.dmp

Download
memory/1116-56-0x0000000000000000-mapping.dmp

Download
memory/1444-54-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1780-63-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download
memory/1780-61-0x0000000000000000-mapping.dmp

Download
memory/1780-81-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

Filesize
64KB

Download
memory/1804-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads