Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 12:17
Static task
static1
Behavioral task
behavioral1
Sample
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe
Resource
win10v2004-20240226-en
General
-
Target
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe
-
Size
92KB
-
MD5
ff9af6e3beebc9df0146f515f68e004e
-
SHA1
f57248526065852ecb491e871160cf1cb23ae22f
-
SHA256
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae
-
SHA512
49bcad9e25613bcb90dcc851a4759cd6e79afc39bd21f32bebe82aebad61b01ad49359527ca2450bdc05331f2c461ad443f976bc52122419e2a9dde9080c7fb5
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AqXeiKozyHj0vThU2BHYZsX3AZMgLzw4g:Qw+asqN5aW/hLMXeHoYQbhvYZD84
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
boston.crypt@tuta.io
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
Processes:
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe = "C:\\Windows\\System32\\b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe" b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exedescription ioc process File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Music\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Libraries\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MRWZP5ZY\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y3HLRHFA\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z9MW37VJ\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Videos\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Desktop\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CJQLK5UF\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Music\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3DCZZ4GN\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Documents\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Pictures\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1658372521-4246568289-2509113762-1000\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Downloads\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Public\Videos\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKWCFGN8\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Admin\Links\desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe -
Drops file in System32 directory 2 IoCs
Processes:
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exedescription ioc process File created C:\Windows\System32\Info.hta b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Windows\System32\b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe -
Drops file in Program Files directory 64 IoCs
Processes:
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadomd28.tlb b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293240.WMF.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\TexturedBlue.css b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7EN.DLL.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\TAG.XSL b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04355_.WMF.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dili.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\library.js b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Windows Media Player\wmpenc.exe b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099186.JPG.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02404_.WMF b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00476_.WMF.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Lagos b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_increaseindent.gif.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLTASKR.FAE.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VisioCustom.propdesc.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST7MDT b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\MSTAG.TLB b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198025.WMF b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.JS.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00212_.WMF b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00525_.WMF b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDREQL.ICO b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149118.JPG.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File opened for modification C:\Program Files (x86)\Common Files\System\wab32.dll b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02423_.WMF.id-05167D95.[boston.crypt@tuta.io].boost b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1868 vssadmin.exe 1464 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exepid process 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1812 vssvc.exe Token: SeRestorePrivilege 1812 vssvc.exe Token: SeAuditPrivilege 1812 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.execmd.execmd.exedescription pid process target process PID 2948 wrote to memory of 2832 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe cmd.exe PID 2948 wrote to memory of 2832 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe cmd.exe PID 2948 wrote to memory of 2832 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe cmd.exe PID 2948 wrote to memory of 2832 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe cmd.exe PID 2832 wrote to memory of 2292 2832 cmd.exe mode.com PID 2832 wrote to memory of 2292 2832 cmd.exe mode.com PID 2832 wrote to memory of 2292 2832 cmd.exe mode.com PID 2832 wrote to memory of 1868 2832 cmd.exe vssadmin.exe PID 2832 wrote to memory of 1868 2832 cmd.exe vssadmin.exe PID 2832 wrote to memory of 1868 2832 cmd.exe vssadmin.exe PID 2948 wrote to memory of 2368 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe cmd.exe PID 2948 wrote to memory of 2368 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe cmd.exe PID 2948 wrote to memory of 2368 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe cmd.exe PID 2948 wrote to memory of 2368 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe cmd.exe PID 2368 wrote to memory of 676 2368 cmd.exe mode.com PID 2368 wrote to memory of 676 2368 cmd.exe mode.com PID 2368 wrote to memory of 676 2368 cmd.exe mode.com PID 2368 wrote to memory of 1464 2368 cmd.exe vssadmin.exe PID 2368 wrote to memory of 1464 2368 cmd.exe vssadmin.exe PID 2368 wrote to memory of 1464 2368 cmd.exe vssadmin.exe PID 2948 wrote to memory of 1888 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe mshta.exe PID 2948 wrote to memory of 1888 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe mshta.exe PID 2948 wrote to memory of 1888 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe mshta.exe PID 2948 wrote to memory of 1888 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe mshta.exe PID 2948 wrote to memory of 2880 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe mshta.exe PID 2948 wrote to memory of 2880 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe mshta.exe PID 2948 wrote to memory of 2880 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe mshta.exe PID 2948 wrote to memory of 2880 2948 b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe"C:\Users\Admin\AppData\Local\Temp\b6c644a1644dd9b81a604fb6ad6a8cebf4a9b14d5c41da633a93ba2f459f31ae.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id-05167D95.[boston.crypt@tuta.io].boostFilesize
143.1MB
MD54bda18f32f80ae518fa4cab55fb1a96a
SHA1673133ba7a7e57e91a077e5f6b03feb976b762f9
SHA256772ae972bfd1fa04ba2a510df14ee9ad7780f9436f782069f96ae7487aaebc05
SHA512729b00a5ca07b75e4d9a00f97d549d4ee9568e1ce9d3f26d69f5d5f432971d16a6161ec8aa362f047f979efcfbec9d01565444a277cc96fc93b2c9e71f16971f
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5e8d08a2b71c6a95d3c4dcb21669108c7
SHA1d2b80df41139d3eb091f27752b05e107f94392db
SHA2560a70067976073140365184ac2aab1e7155d33e371177d19e4b214e41b8961dde
SHA512db253405400b449680bd345c525a9e783b75fdc8c852ad487ba03a163b804159d8e7d051d4d8be1aaee824d340184230546c310454ee7c4a99dae5d3e4c7d0a9
-
memory/1888-20043-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB