Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 16:42
Static task
static1
Behavioral task
behavioral1
Sample
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral2
Sample
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe
Resource
win11-20240704-en
General
-
Target
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe
-
Size
1.0MB
-
MD5
055d1462f66a350d9886542d4d79bc2b
-
SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565
-
SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
-
SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
-
SSDEEP
24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (524) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000\Control Panel\International\Geo\Nation dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe -
Drops startup file 5 IoCs
Processes:
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe = "C:\\Windows\\System32\\dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe" dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exedescription ioc process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Public\Libraries\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Public\Pictures\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Documents\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Public\Downloads\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Public\Documents\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Public\Music\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Music\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Links\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Searches\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Videos\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Public\Videos\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2547232018-1419253926-3356748848-1000\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2547232018-1419253926-3356748848-1000\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Users\Public\desktop.ini dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe -
Drops file in System32 directory 2 IoCs
Processes:
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exedescription ioc process File created C:\Windows\System32\dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Windows\System32\Info.hta dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\THMBNAIL.PNG dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-125.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FPERSON.DLL.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Match.ps1 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\onenote_whatsnew.xml dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-selector.js dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\UtilitiesCpp.winmd dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\ui-strings.js dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\ui-strings.js.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\ui-strings.js.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\msedgeupdateres_kk.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hr-hr\ui-strings.js dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\caution.svg dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\ICE.ELM.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewer\ViewEnv.ddsh dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_contrast-black.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\ui-strings.js.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-400.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInTray.gif.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-80_altform-unplated.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-150.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG2.TTF dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\BREEZE.INF.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-200.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Runtime.dll dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Cryptomining.DATA.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\ui-strings.js dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\tr.pak.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.format.ps1xml.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-60_altform-unplated.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-lightunplated.png dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected].[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.id-5DD523D9.[[email protected]].ncov dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe File opened for modification C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 29328 vssadmin.exe 22480 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exepid process 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 34556 vssvc.exe Token: SeRestorePrivilege 34556 vssvc.exe Token: SeAuditPrivilege 34556 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.execmd.execmd.exedescription pid process target process PID 4572 wrote to memory of 4820 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe cmd.exe PID 4572 wrote to memory of 4820 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe cmd.exe PID 4820 wrote to memory of 5644 4820 cmd.exe mode.com PID 4820 wrote to memory of 5644 4820 cmd.exe mode.com PID 4820 wrote to memory of 29328 4820 cmd.exe vssadmin.exe PID 4820 wrote to memory of 29328 4820 cmd.exe vssadmin.exe PID 4572 wrote to memory of 15580 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe cmd.exe PID 4572 wrote to memory of 15580 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe cmd.exe PID 4572 wrote to memory of 22168 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe mshta.exe PID 4572 wrote to memory of 22168 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe mshta.exe PID 4572 wrote to memory of 22192 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe mshta.exe PID 4572 wrote to memory of 22192 4572 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe mshta.exe PID 15580 wrote to memory of 22256 15580 cmd.exe mode.com PID 15580 wrote to memory of 22256 15580 cmd.exe mode.com PID 15580 wrote to memory of 22480 15580 cmd.exe vssadmin.exe PID 15580 wrote to memory of 22480 15580 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe"C:\Users\Admin\AppData\Local\Temp\dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:5644
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:29328 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:15580 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:22256
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:22480 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:22168
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:22192
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:34556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-5DD523D9.[[email protected]].ncovFilesize
3.2MB
MD55d5277d28de5dc057fd0d35156deda84
SHA1e2555b05fe7d6c08ec74a91f9a3f6253edc478a6
SHA2566dbdac12e8df7acc06d2418fe7e0f30620b51eb5955dd21b79f9a11d4c8d45d5
SHA512f7ea383e9c5d0456ce4ac80b27b440c36eeef9ef10316e10f7cf236b4575b28573188ea3bbf41dff8ac19ab49eb560ca9e49429de43f2c21f3307178914fda3f
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5a804d216b33a1c438ffc06368768fcb4
SHA1dd5ebd6a905026c6709e3c45283e1e995e8595ba
SHA256d86b8ed4f9cf4704509ec6dffb0183e27dbeba11987f0e105f9a5be24e84eef9
SHA512959dad85c6ce712d3b517636837b63d14f75ff2c507211b19787d14688c429a6defef0c42bbf6ee16c0b7ea8369d9c647ea1971b610f223ea8489825a71f754c
-
memory/4572-0-0x0000000000400000-0x000000000056F000-memory.dmpFilesize
1.4MB
-
memory/4572-1-0x000000000ADC0000-0x000000000ADF4000-memory.dmpFilesize
208KB
-
memory/4572-3-0x0000000000400000-0x000000000056F000-memory.dmpFilesize
1.4MB
-
memory/4572-17876-0x0000000000400000-0x000000000056F000-memory.dmpFilesize
1.4MB
-
memory/4572-24969-0x000000000ADC0000-0x000000000ADF4000-memory.dmpFilesize
208KB