dharma | b1968b4be3f82fc26b1e2decdcb8f532915aed847603aeeaf254722bdd411d26

Resubmissions

16-03-2024 17:17

240316-vtswysfd2y 10

16-03-2024 15:31

240316-syg9xafg39 10

15-03-2024 08:15

240315-j5rmgsbg5z 10

Analysis

max time kernel
601s
max time network
602s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
Size

92KB
MD5

e096b294d0ed5f42ca68bc41c47ac27a
SHA1

1d5601986887ead48d036f1401330b8c9fd59eeb
SHA256

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195
SHA512

4d8ead3774210c552a0633db886ea1bfd3c13fcd51fd60efe9b7db8f27ff1a5a6ae4394cbcd8ec01b5514492966b118c4647efcea191313e4f1ec3536ba937ba
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4Ah610ButurulYOGLwf6v7ctk:Qw+asqN5aW/hLnbfSGOGLpv7c+

Score

10^/10

dharma persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! Don't worry, you can return all your files! If you want to restore them, write to the mail: ronrivest@airmail.cc (ronvest@tutanota.de) YOUR ID jerd@420blaze.it Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

ronrivest@airmail.cc

ronvest@tutanota.de

jerd@420blaze.it

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (703) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

Drops startup file 5 IoCs

Processes:

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

Executes dropped EXE 1 IoCs

Processes:

msedge.exe

pid process

4500 msedge.exe
Loads dropped DLL 2 IoCs

Processes:

msedge.exe

pid process

4500 msedge.exe
4500 msedge.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4500	msedge.exe

pid	process
4500	msedge.exe
4500	msedge.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe = "C:\\Windows\\System32\\622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe"	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Public\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

Drops file in System32 directory 2 IoCs

Processes:

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

description	ioc	process
File created	C:\Windows\System32\622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Windows\System32\Info.hta	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

Drops file in Program Files directory 64 IoCs

Processes:

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

description	ioc	process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\measure_poster.jpg.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\SmallTile.scale-125.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteSmallTile.scale-150.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-96.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\CAPSULES.ELM.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado21.tlb	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clretwrc.dll	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\dismiss.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-white.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_opencarat_18.svg.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-150.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_altform-unplated_contrast-white.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations_retina.png.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ko-kr\ui-strings.js	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\ReachFramework.resources.dll.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-150.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\ui-strings.js.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\ui-strings.js.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\ui-strings.js.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationProvider.resources.dll	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Video_Msg_Stop.m4a	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100_contrast-high.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ui-strings.js	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MeetingJoinAxOC.dll.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\WideTile.scale-100.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnssci.dll	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ui-strings.js	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteMedTile.scale-200.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PaySplashScreen.png	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGI.TTF.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\close-2.svg.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ui-strings.js.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tracing.dll.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.id-9C52282F.[ronvest@tutanota.de].r0n	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1836 vssadmin.exe
224 vssadmin.exe

pid	process
1836	vssadmin.exe
224	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

pid	process
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

vssvc.exevssvc.exe

description	pid	process
Token: SeBackupPrivilege	3744	vssvc.exe
Token: SeRestorePrivilege	3744	vssvc.exe
Token: SeAuditPrivilege	3744	vssvc.exe
Token: SeBackupPrivilege	4668	vssvc.exe
Token: SeRestorePrivilege	4668	vssvc.exe
Token: SeAuditPrivilege	4668	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.execmd.execmd.exe

description	pid	process	target process
PID 4572 wrote to memory of 5372	4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	cmd.exe
PID 4572 wrote to memory of 5372	4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	cmd.exe
PID 5372 wrote to memory of 2180	5372	cmd.exe	mode.com
PID 5372 wrote to memory of 2180	5372	cmd.exe	mode.com
PID 5372 wrote to memory of 224	5372	cmd.exe	vssadmin.exe
PID 5372 wrote to memory of 224	5372	cmd.exe	vssadmin.exe
PID 4572 wrote to memory of 6132	4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	cmd.exe
PID 4572 wrote to memory of 6132	4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	cmd.exe
PID 6132 wrote to memory of 6072	6132	cmd.exe	mode.com
PID 6132 wrote to memory of 6072	6132	cmd.exe	mode.com
PID 6132 wrote to memory of 1836	6132	cmd.exe	vssadmin.exe
PID 6132 wrote to memory of 1836	6132	cmd.exe	vssadmin.exe
PID 4572 wrote to memory of 2308	4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	mshta.exe
PID 4572 wrote to memory of 2308	4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	mshta.exe
PID 4572 wrote to memory of 4700	4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	mshta.exe
PID 4572 wrote to memory of 4700	4572	622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe	mshta.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
"C:\Users\Admin\AppData\Local\Temp\622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:5372

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:2180

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:224

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:6132

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:6072

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1836

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:2308

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:4700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3668 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3964 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4500

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\msedge.dll
Filesize
1.8MB

MD5
1d232fb85fc6bed98a1403ebc61bd916

SHA1
029689e4d2f7092669a8dc5d167b34c095350142

SHA256
46ed60671a4838fd789bf3cd579e2bc809529c0620d406a82387944414baa072

SHA512
e7b8f479eb10ae488e2d6981890481c03bef27344a8cb76e9cabb5c621ed36265d2009332c41bb70e1bce131ce4d1a827d6425fd25ffb882590b91fb38f9239e

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\msedge_elf.dll
Filesize
3.5MB

MD5
006c3024a7085e69be59e7660501a040

SHA1
afc826c72b821755b10d14db0ab9c0a879ebb924

SHA256
657c6c108865d2b11dc96f0cbdea82faad75e96f64643106d4b834463cf68678

SHA512
10bc793ac3c5173afdd822f7a8302ff8e3e80317deb60d7409e122a65b8178b0ca4139108887e48149b92622994ff572f5a7f65f849b1e27e580f641751ce06e

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Filesize
3.5MB

MD5
f34143b3cd8796976f9009c4d9d35599

SHA1
e6ae0f6cec96003fcd2fdcaeb035236e950686b2

SHA256
46d32b9df03c70040f6cc5c974481744b175d222e9712cfde4b90cd69508905d

SHA512
a46a622175e12e663241d18b0201981ef5f6efac75a5cc5d5ca1ceb4d63b4b28d65ca761aceb16e5a34b6060bcb985a1b9376fce185264f4b35e90fa40abd7a9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-9C52282F.[ronvest@tutanota.de].r0n
Filesize
2.9MB

MD5
3e7a72752c609b0bfae0fd1272def0cc

SHA1
983bb98a26b16c44703aee28ba963eae6393f795

SHA256
cfd8be0b28b00329b098e27d1b525ddbf80842733d75db9ab10e46c0f4daef9d

SHA512
5cfe996c090626a36fe54696d5ac9448b9f2f22c6709cb03d28327d195d1c25504b4717a7c0e91c7ca9da9ca9261d4ab88e33da65c8aeece98f612b9b80e7ce1

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Filesize
4KB

MD5
d65b3b656d5925db15ebb3f162cad4ec

SHA1
2378f5d4b483aebf4c77c00fe938bdf35af60fc4

SHA256
d017d85fa58fa3b0952d8e84d776a660495afd7f5f9d0a9d4ad5efbd5b85638d

SHA512
e61cf7177183d6c9d92190c639714dfb5d564a5afa72ae7b4830e752614c20162022b025f41330106eb35d8c0400cb02d54505e1ab6e3b84b23c88a50e42ccf5

Download Submit