dharma | 3a12c5a7af5715d62944770c6dd9da366d2f4d20265b9d8f32e79b72705743a0

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
Size

268KB
MD5

ac870d98fcfca054b2c4140bc584c9c6
SHA1

7c49cf18f734afc169914568410bd4fee0a22e4b
SHA256

3a12c5a7af5715d62944770c6dd9da366d2f4d20265b9d8f32e79b72705743a0
SHA512

7e17e7685219258b0ffde772b76defdb1238fbee9cadca67075648b06c7178dd75776fed277fb25d1028cb25a58a43e5888883c9b450e9988fb3acc55c1dd8ac
SSDEEP

6144:ZhWeBAPY6czY/rRPsZdIDgQV7lGLCz1O7i:6eBQHgQ9lZV

Score

10^/10

dharma defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 69F10C1E In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (514) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe = "C:\\Windows\\System32\\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe"	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Windows\System32\Info.hta	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\ui-strings.js	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-localization-l1-2-0.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\km.pak.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\Square71x71Logo.scale-100.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\View3d\3DViewerProductDescription-universal.xml	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\SourceAppService.winmd	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\msasxpress.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_unselected_18.svg.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\plugin.js	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ru_get.svg.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.Misc.v11.1.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_de.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\id.pak	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Tracing.jpg	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\msedgeupdateres_sr-Cyrl-BA.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\EVRGREEN.ELM	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\Add-Numbers.Tests.ps1	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\Microsoft.PowerShell.PackageManagement.resources.dll.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-24.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\AFTRNOON.ELM.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W2.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\eu-es\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ui-strings.js.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-100_contrast-white.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-200_contrast-white.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-256_altform-colorize.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-125.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-30_altform-unplated.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.id-69F10C1E.[[email protected]].bot	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
4920	4992	WerFault.exe	81
2092	4992	WerFault.exe	81
2540	4992	WerFault.exe	81
4016	4992	WerFault.exe	81
4620	4992	WerFault.exe	81
1828	4992	WerFault.exe	81
4112	4992	WerFault.exe	81
832	4992	WerFault.exe	81
2420	4992	WerFault.exe	81
2656	4992	WerFault.exe	81
5012	4992	WerFault.exe	81
1532	4992	WerFault.exe	81
756	4992	WerFault.exe	81
3316	4992	WerFault.exe	81
1028	4992	WerFault.exe	81
3684	4992	WerFault.exe	81
2176	4992	WerFault.exe	81
212	4992	WerFault.exe	81
280	4992	WerFault.exe	81
1460	4992	WerFault.exe	81
532	4992	WerFault.exe	81
8672	4992	WerFault.exe	81
8676	4992	WerFault.exe	81
1664	4992	WerFault.exe	81
10272	4992	WerFault.exe	81
10896	4992	WerFault.exe	81
4816	4992	WerFault.exe	81
6940	4992	WerFault.exe	81
7872	4992	WerFault.exe	81
4644	4992	WerFault.exe	81
10976	4992	WerFault.exe	81
8236	4992	WerFault.exe	81
7332	4992	WerFault.exe	81
6576	4992	WerFault.exe	81
6256	4992	WerFault.exe	81
2268	4992	WerFault.exe	81
9380	4992	WerFault.exe	81
8640	4992	WerFault.exe	81
4308	4992	WerFault.exe	81
5312	4992	WerFault.exe	81
8072	4992	WerFault.exe	81
3000	4992	WerFault.exe	81
5168	4992	WerFault.exe	81
8900	4992	WerFault.exe	81
4116	4992	WerFault.exe	81
5648	4992	WerFault.exe	81
3592	4992	WerFault.exe	81
7276	4992	WerFault.exe	81
8852	4992	WerFault.exe	81
9436	4992	WerFault.exe	81
8972	4992	WerFault.exe	81
9004	4992	WerFault.exe	81
1992	4992	WerFault.exe	81
7824	4992	WerFault.exe	81
300	4992	WerFault.exe	81
7876	4992	WerFault.exe	81
11248	4992	WerFault.exe	81
8148	4992	WerFault.exe	81
8592	4992	WerFault.exe	81
6976	4992	WerFault.exe	81
3956	4992	WerFault.exe	81
1040	4992	WerFault.exe	81
6344	4992	WerFault.exe	81
7504	4992	WerFault.exe	81

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2484	vssadmin.exe
7404	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	4056	vssvc.exe
Token: SeRestorePrivilege	4056	vssvc.exe
Token: SeAuditPrivilege	4056	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4904	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	83
PID 4992 wrote to memory of 4904	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	83
PID 4904 wrote to memory of 1012	4904	cmd.exe	87
PID 4904 wrote to memory of 1012	4904	cmd.exe	87
PID 4904 wrote to memory of 2484	4904	cmd.exe	88
PID 4904 wrote to memory of 2484	4904	cmd.exe	88
PID 4992 wrote to memory of 4800	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	257
PID 4992 wrote to memory of 4800	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	257
PID 4800 wrote to memory of 7704	4800	cmd.exe	260
PID 4800 wrote to memory of 7704	4800	cmd.exe	260
PID 4800 wrote to memory of 7404	4800	cmd.exe	262
PID 4800 wrote to memory of 7404	4800	cmd.exe	262
PID 4992 wrote to memory of 5356	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	271
PID 4992 wrote to memory of 5356	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	271
PID 4992 wrote to memory of 10172	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	277
PID 4992 wrote to memory of 10172	4992	ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe	277

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ac870d98fcfca054b2c4140bc584c9c6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:1012
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 528
  2⤵
  - Program crash
  PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 532
  2⤵
  - Program crash
  PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 576
  2⤵
  - Program crash
  PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 612
  2⤵
  - Program crash
  PID:4016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 632
  2⤵
  - Program crash
  PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 588
  2⤵
  - Program crash
  PID:1828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 548
  2⤵
  - Program crash
  PID:4112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 656
  2⤵
  - Program crash
  PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 724
  2⤵
  - Program crash
  PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 676
  2⤵
  - Program crash
  PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 752
  2⤵
  - Program crash
  PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 796
  2⤵
  - Program crash
  PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 760
  2⤵
  - Program crash
  PID:756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 816
  2⤵
  - Program crash
  PID:3316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 852
  2⤵
  - Program crash
  PID:1028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 888
  2⤵
  - Program crash
  PID:3684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 892
  2⤵
  - Program crash
  PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 888
  2⤵
  - Program crash
  PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 992
  2⤵
  - Program crash
  PID:280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 852
  2⤵
  - Program crash
  PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 912
  2⤵
  - Program crash
  PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 868
  2⤵
  - Program crash
  PID:8672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 872
  2⤵
  - Program crash
  PID:8676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 952
  2⤵
  - Program crash
  PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 936
  2⤵
  - Program crash
  PID:10272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 952
  2⤵
  - Program crash
  PID:10896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 800
  2⤵
  - Program crash
  PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 792
  2⤵
  - Program crash
  PID:6940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1016
  2⤵
  - Program crash
  PID:7872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 892
  2⤵
  - Program crash
  PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 940
  2⤵
  - Program crash
  PID:10976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 868
  2⤵
  - Program crash
  PID:8236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 912
  2⤵
  - Program crash
  PID:7332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1008
  2⤵
  - Program crash
  PID:6576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 896
  2⤵
  - Program crash
  PID:6256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 900
  2⤵
  - Program crash
  PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 932
  2⤵
  - Program crash
  PID:9380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1012
  2⤵
  - Program crash
  PID:8640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 956
  2⤵
  - Program crash
  PID:4308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 796
  2⤵
  - Program crash
  PID:5312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 848
  2⤵
  - Program crash
  PID:8072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 788
  2⤵
  - Program crash
  PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 996
  2⤵
  - Program crash
  PID:5168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 876
  2⤵
  - Program crash
  PID:8900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 840
  2⤵
  - Program crash
  PID:4116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 864
  2⤵
  - Program crash
  PID:5648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 876
  2⤵
  - Program crash
  PID:3592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 828
  2⤵
  - Program crash
  PID:7276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 848
  2⤵
  - Program crash
  PID:8852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 948
  2⤵
  - Program crash
  PID:9436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 836
  2⤵
  - Program crash
  PID:8972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 800
  2⤵
  - Program crash
  PID:9004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 840
  2⤵
  - Program crash
  PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1004
  2⤵
  - Program crash
  PID:7824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 876
  2⤵
  - Program crash
  PID:300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 828
  2⤵
  - Program crash
  PID:7876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 836
  2⤵
  - Program crash
  PID:11248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 924
  2⤵
  - Program crash
  PID:8148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1004
  2⤵
  - Program crash
  PID:8592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 840
  2⤵
  - Program crash
  PID:6976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 792
  2⤵
  - Program crash
  PID:3956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 872
  2⤵
  - Program crash
  PID:1040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1000
  2⤵
  - Program crash
  PID:6344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 748
  2⤵
  - Program crash
  PID:7504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 800
  2⤵
  PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 848
  2⤵
  PID:5256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 748
  2⤵
  PID:7836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 864
  2⤵
  PID:7508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 996
  2⤵
  PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 788
  2⤵
  PID:8308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 936
  2⤵
  PID:10084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 872
  2⤵
  PID:7644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 736
  2⤵
  PID:6836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 844
  2⤵
  PID:7236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 748
  2⤵
  PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 864
  2⤵
  PID:9580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 872
  2⤵
  PID:9552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 844
  2⤵
  PID:6424
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:7704
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:7404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 884
  2⤵
  PID:10372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1136
  2⤵
  PID:6224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1136
  2⤵
  PID:7560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1320
  2⤵
  PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1364
  2⤵
  PID:9656
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:5356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1288
  2⤵
  PID:10196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1528
  2⤵
  PID:10124
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:10172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1556
  2⤵
  PID:10004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1396
  2⤵
  PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4992 -ip 4992
1⤵
PID:4940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4992 -ip 4992
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4992 -ip 4992
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 4992
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4992 -ip 4992
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4992 -ip 4992
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4992 -ip 4992
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4992 -ip 4992
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4992 -ip 4992
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4992 -ip 4992
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4992 -ip 4992
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4992 -ip 4992
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4992 -ip 4992
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4992 -ip 4992
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4992 -ip 4992
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992
1⤵
PID:8872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4992 -ip 4992
1⤵
PID:6728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4992 -ip 4992
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:9384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4992 -ip 4992
1⤵
PID:8608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4992 -ip 4992
1⤵
PID:8932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4992 -ip 4992
1⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:6176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4992 -ip 4992
1⤵
PID:9220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4992 -ip 4992
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4992 -ip 4992
1⤵
PID:8516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4992 -ip 4992
1⤵
PID:8824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992
1⤵
PID:8496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4992 -ip 4992
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4992 -ip 4992
1⤵
PID:9160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4992 -ip 4992
1⤵
PID:9468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:8552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4992 -ip 4992
1⤵
PID:7788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:9252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4992 -ip 4992
1⤵
PID:7796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4992 -ip 4992
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4992 -ip 4992
1⤵
PID:7920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4992 -ip 4992
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4992 -ip 4992
1⤵
PID:8096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4992 -ip 4992
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4992 -ip 4992
1⤵
PID:8980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992
1⤵
PID:6864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:7832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992
1⤵
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4992 -ip 4992
1⤵
PID:7812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4992 -ip 4992
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4992 -ip 4992
1⤵
PID:8788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4992 -ip 4992
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4992 -ip 4992
1⤵
PID:9664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 4992
1⤵
PID:7452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4992 -ip 4992
1⤵
PID:6896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4992 -ip 4992
1⤵
PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:9212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4992 -ip 4992
1⤵
PID:8960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4992 -ip 4992
1⤵
PID:7056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4992 -ip 4992
1⤵
PID:7636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4992 -ip 4992
1⤵
PID:9692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4992 -ip 4992
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4992 -ip 4992
1⤵
PID:7120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4992 -ip 4992
1⤵
PID:6824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4992 -ip 4992
1⤵
PID:7144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4992 -ip 4992
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4992 -ip 4992
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4992 -ip 4992
1⤵
PID:7464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4992 -ip 4992
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4992 -ip 4992
1⤵
PID:9324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4992 -ip 4992
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4992 -ip 4992
1⤵
PID:7680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4992 -ip 4992
1⤵
PID:9968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4992 -ip 4992
1⤵
PID:9444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4992 -ip 4992
1⤵
PID:9788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 4992
1⤵
PID:9620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4992 -ip 4992
1⤵
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4992 -ip 4992
1⤵
PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\javafx-src.zip.id-69F10C1E.[[email protected]].bot

Filesize
5.7MB

MD5
b50dfe297cb2b3480b98041d4b6eb3ff

SHA1
8e337cae48792475a05360cac9220262d0c5060e

SHA256
57a0b90d2b5ab5c1ac830596dde93e33542c8f2c2f4752e1a37db05dc089fc20

SHA512
e5d622098ae60a558de8c7c207824e080d993357bf848193cab14c989e36e2a3903f70e13cc6015884d6fbe106d1deefd093cd9c013f30a1163ec742ad3d70c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
fac097a0d7f0c2d1cfa835cf180cc23e

SHA1
b6ab7054c01f2804c70e41e26f0dcb7558a728b7

SHA256
513c36547a1d2506e1d5684df55fb369968d2867f4a1afec9bfc432b4331f521

SHA512
af645b49d712d9572f03688cf4108b90d707ad569b2783ae825a0ad509639efea220fe2882836d2be4d7201ca48dc40fb97fd0104b0cad4e81cda54e4208a91a

Download Submit
memory/4992-0-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/4992-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4992-3-0x0000000000850000-0x0000000000869000-memory.dmp

Filesize
100KB

Download
memory/4992-2-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/4992-7682-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/4992-24848-0x00000000008B0000-0x00000000009B0000-memory.dmp

Filesize
1024KB

Download
memory/4992-24849-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download