Analysis
-
max time kernel
69s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2023 04:52
Static task
static1
Behavioral task
behavioral1
Sample
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe
Resource
win10v2004-20220812-en
General
-
Target
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe
-
Size
92KB
-
MD5
9dfcd5165fcbf89e319ceca3f5077490
-
SHA1
32fb887ad469eecfaeb66ff98d73da0edd9a7adc
-
SHA256
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875
-
SHA512
4e417f5ac6898bfe60c772270df06e14a452c1a731558a2e334ae1b09acd5928a042d3f17b07b86e773a559c4f173ec022015d4442062b4f53df8bb194356a7d
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4Ai5KS18YgmeMQq1NQDrorHikgd2ZLj:Qw+asqN5aW/hLqKS183iNyrorHi
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
decryptex@airmail.cc
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\UndoProtect.tiff e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Pictures\PushOpen.tiff e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe -
Drops startup file 5 IoCs
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe = "C:\\Windows\\System32\\e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe" e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\Libraries\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Music\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\Pictures\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Documents\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\Downloads\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\Documents\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\Desktop\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Links\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\Videos\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Videos\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Public\Music\desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe -
Drops file in System32 directory 2 IoCs
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exedescription ioc process File created C:\Windows\System32\e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Windows\System32\Info.hta e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exedescription ioc process File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ScCore.dll.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyrun.jar e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\ui-strings.js e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-100.png e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_selected_18.svg.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\Content e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\FindInvoke.dib.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\plugin.js.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEINTL.DLL e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\ui-strings.js.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White@3x.png.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-200_contrast-white.png e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\ui-strings.js e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-100_contrast-white.png e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.catalog e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.scale-125.png e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\illustration-UploadToOD.png e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\standards_poster.png.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h.png.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\office.dll e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\ui-strings.js.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-black_scale-200.png e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\sunec.jar e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\ui-strings.js.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ro.pak.DATA e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_FilledDot_White@1x.png.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\es-419.pak e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SmallTile.scale-125_contrast-white.png e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\logging.properties.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.winmd e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ui-strings.js.id-C26306AC.[decryptex@airmail.cc].dex e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1436 vssadmin.exe 3392 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exepid process 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2636 vssvc.exe Token: SeRestorePrivilege 2636 vssvc.exe Token: SeAuditPrivilege 2636 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.execmd.execmd.exedescription pid process target process PID 4836 wrote to memory of 4480 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe cmd.exe PID 4836 wrote to memory of 4480 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe cmd.exe PID 4480 wrote to memory of 4684 4480 cmd.exe mode.com PID 4480 wrote to memory of 4684 4480 cmd.exe mode.com PID 4480 wrote to memory of 1436 4480 cmd.exe vssadmin.exe PID 4480 wrote to memory of 1436 4480 cmd.exe vssadmin.exe PID 4836 wrote to memory of 3584 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe cmd.exe PID 4836 wrote to memory of 3584 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe cmd.exe PID 3584 wrote to memory of 924 3584 cmd.exe mode.com PID 3584 wrote to memory of 924 3584 cmd.exe mode.com PID 3584 wrote to memory of 3392 3584 cmd.exe vssadmin.exe PID 3584 wrote to memory of 3392 3584 cmd.exe vssadmin.exe PID 4836 wrote to memory of 3436 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe mshta.exe PID 4836 wrote to memory of 3436 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe mshta.exe PID 4836 wrote to memory of 3388 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe mshta.exe PID 4836 wrote to memory of 3388 4836 e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe"C:\Users\Admin\AppData\Local\Temp\e181fb2c45e278661fbbf3fe9b4878e3d7bcee0873d7e1132e3808f10d3e4875.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD52b4ab487fa27ea25492b207f264bed7b
SHA1f17e695fb0ebc1d4387754dacf29f4ea0fb6f4f8
SHA256b2729161710dcc57f1ab351f7a7631dd83a53269b11c09a073d032ecb149e892
SHA512b649c8c62f4feab7d7289c9168454881c0efa3e52f282ec23064aa6a746d44d85277eedafc1b9567c8e6d26b2661e335cfaa96a2d5ee0b19e8331cf318a7a3f1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD52b4ab487fa27ea25492b207f264bed7b
SHA1f17e695fb0ebc1d4387754dacf29f4ea0fb6f4f8
SHA256b2729161710dcc57f1ab351f7a7631dd83a53269b11c09a073d032ecb149e892
SHA512b649c8c62f4feab7d7289c9168454881c0efa3e52f282ec23064aa6a746d44d85277eedafc1b9567c8e6d26b2661e335cfaa96a2d5ee0b19e8331cf318a7a3f1
-
memory/924-136-0x0000000000000000-mapping.dmp
-
memory/1436-134-0x0000000000000000-mapping.dmp
-
memory/3388-139-0x0000000000000000-mapping.dmp
-
memory/3392-137-0x0000000000000000-mapping.dmp
-
memory/3436-138-0x0000000000000000-mapping.dmp
-
memory/3584-135-0x0000000000000000-mapping.dmp
-
memory/4480-132-0x0000000000000000-mapping.dmp
-
memory/4684-133-0x0000000000000000-mapping.dmp