dharma | 0fffd49f114e859b8609a8ea234340d76286e4a8d9741ffb3e42010a6d56c368

Analysis

max time kernel
120s
max time network
97s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
21-01-2023 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
Size

92KB
MD5

029b9543eedadb6b07be801f6813dbaa
SHA1

f83b6342fb36b3b183aefd7755f29edc45915aa9
SHA256

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4
SHA512

0a84a5d688a3972150f57093c7acdfb4e2195d56832114d45023b626498966bb2fe813c05de39463db75016bf461017a082ea8a317ada9bcbb2b7f13699ef6de
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4A6+bBqsG/HKF5K/bDAWtppZSS:Qw+asqN5aW/hL7A6KjsopZN

Score

10^/10

dharma persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All FILES ENCRYPTED "RSA1024" All YOUR FILES HAVE BEEN ENCRYPTED!!! IF YOU WANT TO RESTORE THEM, WRITE US TO THE E-MAIL offtitan@protonmail.com IN THE LETTER WRITE YOUR ID, YOUR ID CB74F34D IF YOU ARE NOT ANSWERED, WRITE TO EMAIL: offtitan@cock.li YOUR SECRET KEY WILL BE STORED ON A SERVER 7 DAYS, AFTER 7 DAYS IT MAY BE OVERWRITTEN BY OTHER KEYS, DON'T PULL TIME, WAITING YOUR EMAIL FREE DECRYPTION FOR PROOF You can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) DECRYPTION PROCESS: When you make sure of decryption possibility transfer the money to our bitcoin wallet. As soon as we receive the money we will send you: 1. Decryption program. 2. Detailed instruction for decryption. 3. And individual keys for decrypting your files. !WARNING! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

offtitan@protonmail.com

offtitan@cock.li

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RemoveFind.tiff	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveAdd.tiff	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Pictures\SwitchOpen.tiff	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Pictures\CloseTest.tiff	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

Drops startup file 5 IoCs

Processes:

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe = "C:\\Windows\\System32\\575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe"	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Public\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2482096546-1136599444-1359412500-1000\desktop.ini	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

Drops file in System32 directory 2 IoCs

Processes:

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

description	ioc	process
File created	C:\Windows\System32\575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Windows\System32\Info.hta	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

Drops file in Program Files directory 64 IoCs

Processes:

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-us\styles\wefgallerywinrt.css	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\es-ES.PhoneNumber.SMS.model	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_el.dll.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_forward_18.svg.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\ui-strings.js	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\msvcp140.dll	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_bn.dll.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\RadialControl\TiltUp_E809_HC_Black_64x64.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.Controls\Canvas.xaml	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-20.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\_Resources\5.rsrc	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\ui-strings.js.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.scale-125.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Rename.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_11c.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\976_24x24x32.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\ui-strings.js.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1251_40x40x32.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\PlaneCutKeepTop.scale-140.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Csi.dll.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\ui-strings.js.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\ui-strings.js.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5313_20x20x32.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_nl.dll	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSO99LRES.DLL.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2017.131.1904.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100_contrast-high.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_unselected_18.svg.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js.id-CB74F34D.[offtitan@protonmail.com].bat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32_altform-unplated.png	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

3820 vssadmin.exe
4396 vssadmin.exe

pid	process
3820	vssadmin.exe
4396	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

pid	process
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 3624 vssvc.exe
Token: SeRestorePrivilege 3624 vssvc.exe
Token: SeAuditPrivilege 3624 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	3624	vssvc.exe
Token: SeRestorePrivilege	3624	vssvc.exe
Token: SeAuditPrivilege	3624	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.execmd.execmd.exe

description	pid	process	target process
PID 1896 wrote to memory of 412	1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	cmd.exe
PID 1896 wrote to memory of 412	1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	cmd.exe
PID 412 wrote to memory of 1464	412	cmd.exe	mode.com
PID 412 wrote to memory of 1464	412	cmd.exe	mode.com
PID 412 wrote to memory of 3820	412	cmd.exe	vssadmin.exe
PID 412 wrote to memory of 3820	412	cmd.exe	vssadmin.exe
PID 1896 wrote to memory of 4964	1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	cmd.exe
PID 1896 wrote to memory of 4964	1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	cmd.exe
PID 4964 wrote to memory of 2488	4964	cmd.exe	mode.com
PID 4964 wrote to memory of 2488	4964	cmd.exe	mode.com
PID 4964 wrote to memory of 4396	4964	cmd.exe	vssadmin.exe
PID 4964 wrote to memory of 4396	4964	cmd.exe	vssadmin.exe
PID 1896 wrote to memory of 4880	1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	mshta.exe
PID 1896 wrote to memory of 4880	1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	mshta.exe
PID 1896 wrote to memory of 4800	1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	mshta.exe
PID 1896 wrote to memory of 4800	1896	575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe	mshta.exe

C:\Users\Admin\AppData\Local\Temp\575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe
"C:\Users\Admin\AppData\Local\Temp\575f5025100185183eb2eff4b301f25402973b72fbd4e3ba84a7dac0b89ca4b4.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:1464

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3820

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:2488

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:4396

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:4880

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:4800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Filesize
13KB

MD5
26b639643a428242be5c0f51b1ae67a5

SHA1
ede89297a2f89c08d8ef3dfd27f310f25fca537e

SHA256
4a64d841ba94c1313398e9733cebfef2c09157ec550f93dc1885da1d3e31fe98

SHA512
899a833ff6a1cebc57d8c3b4d129c7fd9fd90d9f70440d5dfe8dd1dd6dd463ddd53ad7f360eca303716a0c90b40f994640f5c6e8fd6138838484e8dc2e70582f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Filesize
13KB

MD5
26b639643a428242be5c0f51b1ae67a5

SHA1
ede89297a2f89c08d8ef3dfd27f310f25fca537e

SHA256
4a64d841ba94c1313398e9733cebfef2c09157ec550f93dc1885da1d3e31fe98

SHA512
899a833ff6a1cebc57d8c3b4d129c7fd9fd90d9f70440d5dfe8dd1dd6dd463ddd53ad7f360eca303716a0c90b40f994640f5c6e8fd6138838484e8dc2e70582f

Download Submit
memory/412-153-0x0000000000000000-mapping.dmp

Download
memory/1464-156-0x0000000000000000-mapping.dmp

Download
memory/1896-154-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-137-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-126-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-127-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-128-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-129-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-130-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-123-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-132-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-133-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-134-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-135-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-136-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-157-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-138-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-139-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-140-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-158-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-142-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-143-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-145-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-144-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-146-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-147-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-148-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-149-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-150-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-151-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-152-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-124-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-120-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-155-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-131-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-125-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-141-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-159-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-160-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-161-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-162-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-164-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-202-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-165-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-166-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-200-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-201-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-169-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-121-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-171-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-172-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-173-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-174-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-175-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-176-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-177-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-178-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-179-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-180-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-181-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-182-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-183-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/1896-122-0x0000000077DE0000-0x0000000077F6E000-memory.dmp

Filesize
1.6MB

Download
memory/2488-168-0x0000000000000000-mapping.dmp

Download
memory/3820-163-0x0000000000000000-mapping.dmp

Download
memory/4396-170-0x0000000000000000-mapping.dmp

Download
memory/4800-185-0x0000000000000000-mapping.dmp

Download
memory/4880-184-0x0000000000000000-mapping.dmp

Download
memory/4964-167-0x0000000000000000-mapping.dmp

Download