Overview
overview
10Static
static
10samples (2) (2).zip
windows7-x64
1samples (2) (2).zip
windows10-2004-x64
1083e147374...08.exe
windows7-x64
8083e147374...08.exe
windows10-2004-x64
812437a49d2...3d.exe
windows7-x64
712437a49d2...3d.exe
windows10-2004-x64
71945c44901...7e.exe
windows7-x64
91945c44901...7e.exe
windows10-2004-x64
102040fa2a3c...d4.exe
windows7-x64
12040fa2a3c...d4.exe
windows10-2004-x64
12b5109e9a2...d9.exe
windows7-x64
102b5109e9a2...d9.exe
windows10-2004-x64
103538750cfe...5f.exe
windows7-x64
103538750cfe...5f.exe
windows10-2004-x64
105d96952d47...5f.exe
windows7-x64
105d96952d47...5f.exe
windows10-2004-x64
1063fb410fc5...22.exe
windows7-x64
763fb410fc5...22.exe
windows10-2004-x64
767beeb7a19...08.exe
windows7-x64
367beeb7a19...08.exe
windows10-2004-x64
16e5678ebd4...71.exe
windows7-x64
36e5678ebd4...71.exe
windows10-2004-x64
371506a3322...fb.exe
windows7-x64
1071506a3322...fb.exe
windows10-2004-x64
10734b9974ec...6d.exe
windows7-x64
10734b9974ec...6d.exe
windows10-2004-x64
1081a27b3dcf...40.exe
windows7-x64
981a27b3dcf...40.exe
windows10-2004-x64
10a1bd0fa8ad...46.exe
windows7-x64
10a1bd0fa8ad...46.exe
windows10-2004-x64
10a465bc0871...e3.exe
windows7-x64
6a465bc0871...e3.exe
windows10-2004-x64
6Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 15:12
Behavioral task
behavioral1
Sample
samples (2) (2).zip
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
samples (2) (2).zip
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral9
Sample
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral12
Sample
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral13
Sample
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe
Resource
win7-20231215-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral14
Sample
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral15
Sample
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral17
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Resource
win7-20231215-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral24
Sample
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral25
Sample
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral26
Sample
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral27
Sample
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral28
Sample
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral29
Sample
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral30
Sample
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral31
Sample
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
-
Size
640KB
-
MD5
fb702537f0c25b34cc2b3dfb69025a85
-
SHA1
eb8cae72ffd5361a977e186cb78fc64055748f00
-
SHA256
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e
-
SHA512
94d2a4d9a5c689c13934bd9d2f236a421a63e90fcf6d3dd7362cbe7c64e1faacb68412b92ce743ee49e4e8adf4f91a495ccd8d0d3605e464bfccb26f31d1b843
-
SSDEEP
12288:Z2X8+SnYa6TF42coyaLlGSDVmcUjErioq8iHiB6k:cM+SnAF4Uyycj24Hs6k
Score
10/10
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (495) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe = "C:\\Windows\\System32\\1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe" 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Public\Documents\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Public\Music\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3336304223-2978740688-3645194410-1000\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Users\Public\desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ui-strings.js.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\View3d\3DViewerProductDescription-universal.xml 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\fillandsign.svg.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\PlayStore_icon.svg.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-cn\ui-strings.js.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\msvcp140_1_app.dll 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fr.pak.DATA.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Immutable.dll 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\Microsoft.PackageManagement.resources.dll.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\msedgeupdateres_fr.dll.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\PackageManagementDscUtilities.strings.psd1.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-100.png 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\ui-strings.js.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\ui-strings.js 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\id.pak 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationCore.resources.dll.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae\ui-strings.js 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation2x.png.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\AppxManifest.xml 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected].[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\ui-strings.js.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.NonGeneric.dll.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.Design.resources.dll.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-lightunplated.png 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\ui-strings.js.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLCALL32.DLL 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Sockets.dll 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-32_altform-unplated.png 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\Java\jdk-1.8\jre\LICENSE.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-unplated_contrast-white.png 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\ui-strings.js.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.id-833605E4.[[email protected]].AUDIT 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotContain.snippets.ps1xml 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-125.png 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5900 vssadmin.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\ " Ü"!`: R 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2544 vssvc.exe Token: SeRestorePrivilege 2544 vssvc.exe Token: SeAuditPrivilege 2544 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 756 wrote to memory of 2732 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 92 PID 756 wrote to memory of 2732 756 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 92 PID 2732 wrote to memory of 1784 2732 cmd.exe 93 PID 2732 wrote to memory of 1784 2732 cmd.exe 93 PID 2732 wrote to memory of 5900 2732 cmd.exe 94 PID 2732 wrote to memory of 5900 2732 cmd.exe 94 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe"C:\Users\Admin\AppData\Local\Temp\1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1784
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5900
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-833605E4.[[email protected]].AUDIT
Filesize1.3MB
MD560d3b96bd4015920f764f0afcf1318c9
SHA105a5b7d417e9a2003ddc9f8b2ffe83ab2f28fca3
SHA256722b881f088b5eb2fa68ca7befde2c991702d30f916c5597f7b1df96e09b6404
SHA512f693f97dba414981f516dbfff079de2df19bf11094c4007ea7a856fbbb6da32f8e447a6897728bf66dd81a9344e44d1f82cc9bc3e24edee86e7836a0525654be