Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe
Resource
win10v2004-20240221-en
General
-
Target
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe
-
Size
507KB
-
MD5
0ab47cd53a26a51152d973210faf75e6
-
SHA1
af3b11c1c9b28122514eb563be62842c0cee9dd8
-
SHA256
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1
-
SHA512
d692a9bb955bafbcda7f1f6021e6c43cd8a8a03a1136d3e213cda9cba7d97906ed799b114eb39f95fbb17b5721b83d38b65f30589370193f7a2636dfa4350d54
-
SSDEEP
12288:yRzQp4CmtvyFfdGSL33Q4FIb2fBGohp5h:ibPl3M33jfAon5
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects win.dharma. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4644-2380-0x0000000000400000-0x0000000000419000-memory.dmp win_dharma_auto -
Identifies DHARMA ransomware 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4644-2380-0x0000000000400000-0x0000000000419000-memory.dmp Windows_Ransomware_Dharma_aa5eefed behavioral2/memory/4644-2380-0x0000000000400000-0x0000000000419000-memory.dmp Windows_Ransomware_Dharma_b31cac3f behavioral2/memory/4644-2380-0x0000000000400000-0x0000000000419000-memory.dmp Windows_Ransomware_Dharma_e9319e4a behavioral2/memory/4644-2380-0x0000000000400000-0x0000000000419000-memory.dmp Windows_Ransomware_Dharma_942142e3 -
Renames multiple (426) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
Processes:
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Admin.lnk 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe = "C:\\Windows\\System32\\1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe" 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Public\Music\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Public\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3844919115-497234255-166257750-1000\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3844919115-497234255-166257750-1000\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe -
Drops file in System32 directory 1 IoCs
Processes:
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exedescription ioc process File created C:\Windows\System32\1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exedescription pid process target process PID 4480 set thread context of 4644 4480 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationUI.resources.dll.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\ReachFramework.resources.dll.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemCore.dll 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-150.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\ui-strings.js.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FDATE.DLL 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\virgo_mycomputer_folder_icon.svg.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-unplated.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\nn.pak.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Xaml.resources.dll.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\SmallTile.scale-100.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_24.svg 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\Styling\css\Content.css 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close2x.png.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\qu.pak.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_contrast-black.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\ui-strings.js 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwgl_plugin.dll 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Windows.Forms.resources.dll 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\SmallTile.scale-125.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_es-MX.json 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-48_altform-unplated.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-150.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ms_get.svg 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\ui-strings.js.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-400.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\WideTile.scale-125.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-100_contrast-black.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Confirmation.m4a 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-white_scale-200.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeApi.dll 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\concrt140.dll 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\avformat-58_ms.dll 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\es-ES\msader15.dll.mui 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OutlookAccount.scale-100.png 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.id-23AC1F56.[MerlinWebster@aol.com].harma 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4128 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exepid process 4480 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4480 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3620 vssvc.exe Token: SeRestorePrivilege 3620 vssvc.exe Token: SeAuditPrivilege 3620 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.execmd.exedescription pid process target process PID 4480 wrote to memory of 4644 4480 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe PID 4480 wrote to memory of 4644 4480 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe PID 4480 wrote to memory of 4644 4480 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe PID 4480 wrote to memory of 4644 4480 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe PID 4644 wrote to memory of 1456 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe cmd.exe PID 4644 wrote to memory of 1456 4644 1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe cmd.exe PID 1456 wrote to memory of 3932 1456 cmd.exe mode.com PID 1456 wrote to memory of 3932 1456 cmd.exe mode.com PID 1456 wrote to memory of 4128 1456 cmd.exe vssadmin.exe PID 1456 wrote to memory of 4128 1456 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe"C:\Users\Admin\AppData\Local\Temp\1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exeC:\Users\Admin\AppData\Local\Temp\1705aa5fa77ee0e563073c266fe570d324ba1adf6f9f26a8ed0e908773f046a1.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-23AC1F56.[MerlinWebster@aol.com].harmaFilesize
320KB
MD5e1b4268f4c281e106fb77ca917788d4d
SHA1109832b379bfcf882a1cbcbbf68027004085961e
SHA2563a2ac3f003ae14864933a5956f62b2ef015f106518d1726a09f3365cbc8cf8c0
SHA51241102c0fd7f755212c0acbf19b8c6063a53150a73b8c6b7181eaf471a094c4cd184bc905f96a31104d37d69d4e7986181e2ef5e4c06bc046b7dc0276e7e7e0fe
-
memory/4480-0-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/4480-2-0x00000000023D0000-0x00000000023F0000-memory.dmpFilesize
128KB
-
memory/4480-3-0x00000000023D0000-0x00000000023F0000-memory.dmpFilesize
128KB
-
memory/4644-2380-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB