Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301aabfaa41...50.exe
windows10-2004-x64
301c647838c...7f.exe
windows7-x64
1001c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows7-x64
602f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows7-x64
101a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows7-x64
1a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows7-x64
101af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows7-x64
31b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows7-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows7-x64
101b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows7-x64
11ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows7-x64
101c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows7-x64
61c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows7-x64
1ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows7-x64
101d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows7-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows7-x64
1dbbed25cf...88.exe
windows10-2004-x64
Resubmissions
14/02/2025, 20:11
250214-yypxmsyjf1 1005/02/2025, 09:01
250205-kyy9eszjft 1015/10/2024, 03:47
241015-ecgjlashrh 1005/08/2024, 04:49
240805-ffygys1eke 1005/08/2024, 03:50
240805-eee4jszepd 10Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
General
-
Target
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
-
Size
92KB
-
MD5
786ce74458720ec55b824586d2e5666d
-
SHA1
6f62e7fe75a0876939e0dd95d314b83e25e1e395
-
SHA256
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
-
SHA512
083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (526) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe = "C:\\Windows\\System32\\1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe" 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\Music\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Windows\System32\Info.hta 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\View3d\3DViewerProductDescription-universal.xml 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare71x71Logo.scale-200_contrast-white.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_altform-unplated_contrast-black.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\ui-strings.js.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-synch-l1-2-0.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_empty_state.svg.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AirSpace.Etw.man.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Text.Encoding.CodePages.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DcfMsoWrapper.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\editpdf.svg.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-200.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-processthreads-l1-1-1.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected].[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main.css 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\StoreLogo.contrast-black_scale-100.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-945322488-2060912225-3527527000-1000-MergedResources-0.pri 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\Settings.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-100.HCBlack.png 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner2x.gif.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sk-sk\ui-strings.js.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ui-strings.js 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\SetupTeardown.ps1 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Shared.v11.1.dll.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\vccorlib140.dll 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt.id-AB821591.[[email protected]].data 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3268 vssadmin.exe 6220 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 5820 vssvc.exe Token: SeRestorePrivilege 5820 vssvc.exe Token: SeAuditPrivilege 5820 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3620 wrote to memory of 1224 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 84 PID 3620 wrote to memory of 1224 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 84 PID 1224 wrote to memory of 684 1224 cmd.exe 86 PID 1224 wrote to memory of 684 1224 cmd.exe 86 PID 1224 wrote to memory of 3268 1224 cmd.exe 87 PID 1224 wrote to memory of 3268 1224 cmd.exe 87 PID 3620 wrote to memory of 5304 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 91 PID 3620 wrote to memory of 5304 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 91 PID 5304 wrote to memory of 8016 5304 cmd.exe 93 PID 5304 wrote to memory of 8016 5304 cmd.exe 93 PID 5304 wrote to memory of 6220 5304 cmd.exe 94 PID 5304 wrote to memory of 6220 5304 cmd.exe 94 PID 3620 wrote to memory of 8888 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 95 PID 3620 wrote to memory of 8888 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 95 PID 3620 wrote to memory of 4396 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 96 PID 3620 wrote to memory of 4396 3620 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe 96 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe"C:\Users\Admin\AppData\Local\Temp\1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:684
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3268
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:8016
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6220
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:8888
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:4396
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5820
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-AB821591.[[email protected]].data
Filesize2.7MB
MD575b848705746f1dc9e493736acc10b7e
SHA11dfa04c62d7d4a0c19ef1a1fd693e5f5a3efc1f6
SHA256363af037b4a07ead5c1f43ff35288ae7d8554755427d933780a6969e6809dc4f
SHA51245d5f9789a6fdaff7ed7e2f4911dfc98322e6d53a2c85fd3a9bfa819c7cc5bdf07971ca240b4f5511fc9a20afa4c3e71cf4e6f12d8a5655d93b9e207d6df76a8
-
Filesize
7KB
MD57e28ecdc72a8c16241f91c5eed49c0eb
SHA18f317dc5bee51e0ae78f2baab1992d4fe58bbb92
SHA256006a9355baa4a750b13225caae35227d4bf040a7076e79283efce0361d5b10c9
SHA5123a6071d69861c6353fa70ca78cdaf61d9bdba444932bc56899680a324f33313cf85e60748944e71c71f07ac7565677628ad8e65c0162afb6f2b7d31d3b08f236