Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 07:34
Static task
static1
Behavioral task
behavioral1
Sample
0f2c4685932a74e8a7bd4733ceea0fcc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0f2c4685932a74e8a7bd4733ceea0fcc.exe
Resource
win10v2004-20231215-en
General
-
Target
0f2c4685932a74e8a7bd4733ceea0fcc.exe
-
Size
92KB
-
MD5
0f2c4685932a74e8a7bd4733ceea0fcc
-
SHA1
51201bbf3d9b532d8882a4cda4fa40f35d093179
-
SHA256
b0817a23a0189f43f8ceeb9899ade839f07da58dcf5a522d563c15382fba305a
-
SHA512
c397d75914c49eba7725f886845aa8a6b02cfbbaef59f858507b0ebce836aafb9743bafd2f409097ec45eb68e0c333cfda0fc0607b37ddbbaca6c23e2f73d461
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A+owcTqXrUMW/E4RwlROQA1d2x3u:Qw+asqN5aW/hL0X6wbmd2x3u
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
itteam122@aol.com
itteam122@techmail.info
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (495) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Drops startup file 5 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0f2c4685932a74e8a7bd4733ceea0fcc.exe 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0f2c4685932a74e8a7bd4733ceea0fcc.exe = "C:\\Windows\\System32\\0f2c4685932a74e8a7bd4733ceea0fcc.exe" 0f2c4685932a74e8a7bd4733ceea0fcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 0f2c4685932a74e8a7bd4733ceea0fcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Public\Documents\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Public\Videos\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-768304381-2824894965-3840216961-1000\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Music\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-768304381-2824894965-3840216961-1000\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Public\Music\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Drops file in System32 directory 2 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process File created C:\Windows\System32\0f2c4685932a74e8a7bd4733ceea0fcc.exe 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Windows\System32\Info.hta 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Drops file in Program Files directory 64 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\manifest.json 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTree.v8.1.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\hprof.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\ui-strings.js 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.Primitives.resources.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\identity_helper.Sparse.Canary.msix.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-selector.js.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\selector.js.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mip_core.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.UnmanagedMemoryStream.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White@2x.png.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-200.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\msvcp100.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.resources.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-40.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\ui-strings.js.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clrjit.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Core.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-math-l1-1-0.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationTypes.resources.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-lightunplated.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proofing.msi.16.en-us.vreg.dat.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\SmallTile.scale-125.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-string-l1-1-0.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\ui-strings.js.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main-selector.css.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-processthreads-l1-1-1.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Java\jdk-1.8\COPYRIGHT 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-down_32.svg.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_bs.dll.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\ui-strings.js.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_super.gif.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-125_contrast-white.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupWideTile.scale-200.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-150.png 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.id-585F9D2C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 3508 vssadmin.exe 8836 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exepid process 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4612 vssvc.exe Token: SeRestorePrivilege 4612 vssvc.exe Token: SeAuditPrivilege 4612 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.execmd.execmd.exedescription pid process target process PID 1412 wrote to memory of 2292 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe cmd.exe PID 1412 wrote to memory of 2292 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe cmd.exe PID 2292 wrote to memory of 3940 2292 cmd.exe mode.com PID 2292 wrote to memory of 3940 2292 cmd.exe mode.com PID 2292 wrote to memory of 3508 2292 cmd.exe vssadmin.exe PID 2292 wrote to memory of 3508 2292 cmd.exe vssadmin.exe PID 1412 wrote to memory of 8796 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe cmd.exe PID 1412 wrote to memory of 8796 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe cmd.exe PID 8796 wrote to memory of 404 8796 cmd.exe mode.com PID 8796 wrote to memory of 404 8796 cmd.exe mode.com PID 8796 wrote to memory of 8836 8796 cmd.exe vssadmin.exe PID 8796 wrote to memory of 8836 8796 cmd.exe vssadmin.exe PID 1412 wrote to memory of 5492 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe mshta.exe PID 1412 wrote to memory of 5492 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe mshta.exe PID 1412 wrote to memory of 5072 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe mshta.exe PID 1412 wrote to memory of 5072 1412 0f2c4685932a74e8a7bd4733ceea0fcc.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f2c4685932a74e8a7bd4733ceea0fcc.exe"C:\Users\Admin\AppData\Local\Temp\0f2c4685932a74e8a7bd4733ceea0fcc.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-585F9D2C.[itteam122@aol.com].ROGERFilesize
17KB
MD5523efc3b06a2c002b240e78616e3a169
SHA1e17e666446bf94fc2d9b3f3d9985612005ceb2f8
SHA25676c68c3e1ff1bcc8f7445321381c3f4a766233d5dc35ce6d56e5af59b1118458
SHA51273a97614b45a36d9ef747c073a0f14d4f836ab45fafc5f1b28db9d06dbf24a2a4968d18741bb0b664b5b2edd3a7123176a3ac2a0c6dc4d4e33477a21628a0363
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5db051327d931ae4e7bb9cbb440fc99e5
SHA1458fcce1c38b30e398c5507613b7f3dd83c6200e
SHA256178f3fb5bc2a1a8d9acc5cdd357b982ba5a86602028311d39585085e96238e79
SHA512cbee64662627e7483923a02ff366f33dae1b534b575d55179d59894471906508f1ff26dd5a9e5619223d0f120379a7c773261b6e11f7ab5c2c8c24a462f03d7e