Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 08:34
Behavioral task
behavioral1
Sample
cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe
Resource
win10v2004-20240426-en
General
-
Target
cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe
-
Size
1.9MB
-
MD5
f09a781eeb97acf68c8c1783e76c29e6
-
SHA1
ec2b7eebfcbf263424ae194817060eac44c380c7
-
SHA256
cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64
-
SHA512
972fc4759d344c3eab157fe8bb345596592895ab9d27546961a93047142e8236dd876f3449a9f60dd5eb93a54035dcd3d7c8d70d468e3233341bfa4d674cfa64
-
SSDEEP
49152:jL7kITp6hTJEfHdQ2+Sd3KmkZt1EOS09VE8zbRfc7id4oPg:YITpmafy2+S5KmkZt1EOSP8zdfc7i5P
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies DHARMA ransomware 8 IoCs
resource yara_rule behavioral1/memory/1720-4-0x0000000000400000-0x00000000005E6000-memory.dmp Windows_Ransomware_Dharma_aa5eefed behavioral1/memory/1720-4-0x0000000000400000-0x00000000005E6000-memory.dmp Windows_Ransomware_Dharma_b31cac3f behavioral1/memory/1720-4-0x0000000000400000-0x00000000005E6000-memory.dmp Windows_Ransomware_Dharma_e9319e4a behavioral1/memory/1720-4-0x0000000000400000-0x00000000005E6000-memory.dmp Windows_Ransomware_Dharma_942142e3 behavioral1/memory/1720-9722-0x0000000000400000-0x00000000005E6000-memory.dmp Windows_Ransomware_Dharma_aa5eefed behavioral1/memory/1720-9722-0x0000000000400000-0x00000000005E6000-memory.dmp Windows_Ransomware_Dharma_b31cac3f behavioral1/memory/1720-9722-0x0000000000400000-0x00000000005E6000-memory.dmp Windows_Ransomware_Dharma_e9319e4a behavioral1/memory/1720-9722-0x0000000000400000-0x00000000005E6000-memory.dmp Windows_Ransomware_Dharma_942142e3 -
Renames multiple (314) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x00000000005E6000-memory.dmp UPX behavioral1/memory/1720-1-0x0000000000400000-0x00000000005E6000-memory.dmp UPX behavioral1/memory/1720-4-0x0000000000400000-0x00000000005E6000-memory.dmp UPX behavioral1/memory/1720-9722-0x0000000000400000-0x00000000005E6000-memory.dmp UPX -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe -
Loads dropped DLL 8 IoCs
pid Process 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 1472 MsiExec.exe 2056 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x00000000005E6000-memory.dmp upx behavioral1/memory/1720-1-0x0000000000400000-0x00000000005E6000-memory.dmp upx -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe = "C:\\Windows\\System32\\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe" cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Searches\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Pictures\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FOCT73XI\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Links\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Documents\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GRIS23UI\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Libraries\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Videos\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Music\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Desktop\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RI1YAXDZ\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Videos\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\94JSLQ0Q\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Downloads\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D4RBNUS7\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3S5WMYWY\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Public\Documents\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Windows\System32\Info.hta cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\uk.txt.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Hobart cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185828.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285782.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107358.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR98.POC.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198712.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00720_.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02431_.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01166_.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Windows Sidebar\es-ES\Sidebar.exe.mui cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OISAPP.DLL.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL98.POC.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_it.properties cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099189.JPG.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185834.WMF cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\MP00021_.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7FR.DLL.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\weather.js cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400005.PNG cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285360.WMF cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21294_.GIF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21321_.GIF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR41F.GIF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285462.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00132_.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0214098.WAV.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.HTM cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106146.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\SOCIALCONNECTORRES.DLL cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02444_.WMF.id-00DD6F08.[[email protected] ].wiki cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIE1CF.tmp msiexec.exe File created C:\Windows\Installer\f76d9eb.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIDA58.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDDB5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDEA1.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIDE71.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDEC1.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76d9eb.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIDB43.tmp msiexec.exe File created C:\Windows\Installer\f76d9ee.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIDB82.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDF3F.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2532 vssadmin.exe 1784 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry class 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 2992 msiexec.exe 2992 msiexec.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeBackupPrivilege 1508 vssvc.exe Token: SeRestorePrivilege 1508 vssvc.exe Token: SeAuditPrivilege 1508 vssvc.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeSecurityPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe Token: SeRestorePrivilege 2992 msiexec.exe Token: SeTakeOwnershipPrivilege 2992 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2680 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 29 PID 1720 wrote to memory of 2680 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 29 PID 1720 wrote to memory of 2680 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 29 PID 1720 wrote to memory of 2680 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 29 PID 2680 wrote to memory of 2500 2680 cmd.exe 31 PID 2680 wrote to memory of 2500 2680 cmd.exe 31 PID 2680 wrote to memory of 2500 2680 cmd.exe 31 PID 2680 wrote to memory of 2532 2680 cmd.exe 32 PID 2680 wrote to memory of 2532 2680 cmd.exe 32 PID 2680 wrote to memory of 2532 2680 cmd.exe 32 PID 1720 wrote to memory of 2184 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 38 PID 1720 wrote to memory of 2184 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 38 PID 1720 wrote to memory of 2184 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 38 PID 1720 wrote to memory of 2184 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 38 PID 2184 wrote to memory of 3512 2184 cmd.exe 41 PID 2184 wrote to memory of 3512 2184 cmd.exe 41 PID 2184 wrote to memory of 3512 2184 cmd.exe 41 PID 2184 wrote to memory of 1784 2184 cmd.exe 42 PID 2184 wrote to memory of 1784 2184 cmd.exe 42 PID 2184 wrote to memory of 1784 2184 cmd.exe 42 PID 1720 wrote to memory of 2236 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 43 PID 1720 wrote to memory of 2236 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 43 PID 1720 wrote to memory of 2236 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 43 PID 1720 wrote to memory of 2236 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 43 PID 1720 wrote to memory of 2264 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 44 PID 1720 wrote to memory of 2264 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 44 PID 1720 wrote to memory of 2264 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 44 PID 1720 wrote to memory of 2264 1720 cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe 44 PID 2992 wrote to memory of 1472 2992 msiexec.exe 45 PID 2992 wrote to memory of 1472 2992 msiexec.exe 45 PID 2992 wrote to memory of 1472 2992 msiexec.exe 45 PID 2992 wrote to memory of 1472 2992 msiexec.exe 45 PID 2992 wrote to memory of 1472 2992 msiexec.exe 45 PID 2992 wrote to memory of 1472 2992 msiexec.exe 45 PID 2992 wrote to memory of 1472 2992 msiexec.exe 45 PID 2992 wrote to memory of 2056 2992 msiexec.exe 46 PID 2992 wrote to memory of 2056 2992 msiexec.exe 46 PID 2992 wrote to memory of 2056 2992 msiexec.exe 46 PID 2992 wrote to memory of 2056 2992 msiexec.exe 46 PID 2992 wrote to memory of 2056 2992 msiexec.exe 46 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe"C:\Users\Admin\AppData\Local\Temp\cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2500
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2532
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3512
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1784
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2236
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2264
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89C04E51E1C7B2A3DFD029D7A2DB5CDF2⤵
- Loads dropped DLL
PID:1472
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 3688F0C2F6DE4630CFD922FC18A7E9CE2⤵
- Loads dropped DLL
PID:2056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-00DD6F08.[[email protected] ].wiki
Filesize6.3MB
MD5e8d0bfc92343a8767769d9dae6906cc0
SHA122f9ca65a5f3689cea381150c386d2599ebeb759
SHA2567ece875a4f06163fb26ca229806e5104f48c83c614d35699ac092179b9432ac5
SHA51256e041fe8ee5a1fc14ba31dd078d2a26feb8e787bc7458a75565bc9bc52b86fc5553acf3c5bb68e4d4142dc42291a79887fd678565026198d6ff92b3bd41d4dd
-
Filesize
13KB
MD55c6724bee9c1a4bbab492cb17a56d9bb
SHA1a0c583db7c72b42346f1e5dd047fefe78e5d8447
SHA256efc71c40fc4ebe6c98557273ee8134258628dbd7fe76f54be3234ba0d14ed88c
SHA5126c190739277439f793077bc406ba729a1a93a165d8a5a06dd34d53a73bed5632a47a10a1ab8346dc43cfb82f30b2b85ecef7907aaddccc7cc1336ed48b89e1aa
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
148KB
MD533908aa43ac0aaabc06a58d51b1c2cca
SHA10a0d1ce3435abe2eed635481bac69e1999031291
SHA2564447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46
-
Filesize
86KB
MD5ff58cd07bf4913ef899efd2dfb112553
SHA1f14c1681de808543071602f17a6299f8b4ba2ae8
SHA2561afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA51223e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d