dharma | 526b432752bac2edc49ee4a3cc2428f5d7249fa3afe66deba5d23e12e4bce68c

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rack/666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
Size

323KB
MD5

dfe0390e501faf0de5ba5093304e8ac2
SHA1

266ca584a811b8ccd4d513a0b007d206575a60a9
SHA256

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6
SHA512

0423b083ada2a6c201cf777d14e74e73d9484c9f34f8681e86e4265e80ee50a5c454c55c5d6e9dbc858abeb97c28bd51d44fe4dd113a7a54ebe6a15241de7373
SSDEEP

6144:7/nQNudGK9+oNitAoYdbmTE/T69Jozt6RshzlaydO5YtPIrm:7/nqudGPoNitvyaQm90tJJ/aYD

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 1B20934B In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (532) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe = "C:\\Windows\\System32\\666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe"	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Public\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

Drops file in System32 directory 2 IoCs

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

description	ioc	process
File created	C:\Windows\System32\666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Windows\System32\Info.hta	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

Drops file in Program Files directory 64 IoCs

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-400.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\MusicStoreLogo.scale-100_contrast-black.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\tt.pak	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\THMBNAIL.PNG.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\sendforsignature.svg.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ui-strings.js.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-400.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointPortalSite.ico.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-200.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\ui-strings.js	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.strings.psd1.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-black.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\ui-strings.js	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-convert-l1-1-0.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\ruleset_en-GB_TTS.lua	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\SmallTile.scale-125.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_altform-lightunplated.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Linq.Parallel.dll	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.DATA	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_contrast-high.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\ARCTIC.INF.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\168.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-150.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-cn\ui-strings.js.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\LogoDev.png.DATA.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-40.png	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_2x.png.id-1B20934B.[[email protected]].money	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3716	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4764	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
216	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
3440	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4760	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
2096	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4748	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
3176	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
3020	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4508	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
1460	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
2556	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
2900	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4672	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4884	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
2816	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4352	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
3128	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
3452	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
280	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4124	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
220	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
1340	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
3304	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4728	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
3356	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
2692	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4748	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
2168	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
416	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6084	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5888	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4536	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5876	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5716	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7532	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6312	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6384	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6592	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6648	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6496	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5416	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6776	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7648	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6692	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6800	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7044	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7908	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
4140	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6264	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7712	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7328	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7188	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5228	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6060	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
1128	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5248	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6684	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7636	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6152	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5592	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
7500	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
6740	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
3868	5084	WerFault.exe	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

5064 vssadmin.exe
7204 vssadmin.exe

pid	process
5064	vssadmin.exe
7204	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

pid	process
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 3596 vssvc.exe
Token: SeRestorePrivilege 3596 vssvc.exe
Token: SeAuditPrivilege 3596 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	3596	vssvc.exe
Token: SeRestorePrivilege	3596	vssvc.exe
Token: SeAuditPrivilege	3596	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.execmd.execmd.exe

description	pid	process	target process
PID 5084 wrote to memory of 4416	5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	cmd.exe
PID 5084 wrote to memory of 4416	5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	cmd.exe
PID 4416 wrote to memory of 1996	4416	cmd.exe	mode.com
PID 4416 wrote to memory of 1996	4416	cmd.exe	mode.com
PID 4416 wrote to memory of 5064	4416	cmd.exe	vssadmin.exe
PID 4416 wrote to memory of 5064	4416	cmd.exe	vssadmin.exe
PID 5084 wrote to memory of 5492	5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	cmd.exe
PID 5084 wrote to memory of 5492	5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	cmd.exe
PID 5492 wrote to memory of 6800	5492	cmd.exe	mode.com
PID 5492 wrote to memory of 6800	5492	cmd.exe	mode.com
PID 5492 wrote to memory of 7204	5492	cmd.exe	vssadmin.exe
PID 5492 wrote to memory of 7204	5492	cmd.exe	vssadmin.exe
PID 5084 wrote to memory of 5892	5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	mshta.exe
PID 5084 wrote to memory of 5892	5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	mshta.exe
PID 5084 wrote to memory of 7536	5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	mshta.exe
PID 5084 wrote to memory of 7536	5084	666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe	mshta.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Rack\666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe
"C:\Users\Admin\AppData\Local\Temp\Rack\666a3daa2ef51e1b14e0abeddecce8ba836a27cc37781899c88a3b6f328d17e6.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:1996
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 528
  2⤵
  - Program crash
  PID:3716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 568
  2⤵
  - Program crash
  PID:4764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 576
  2⤵
  - Program crash
  PID:216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 532
  2⤵
  - Program crash
  PID:3440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 572
  2⤵
  - Program crash
  PID:4760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 548
  2⤵
  - Program crash
  PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 640
  2⤵
  - Program crash
  PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 640
  2⤵
  - Program crash
  PID:3176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 740
  2⤵
  - Program crash
  PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 716
  2⤵
  - Program crash
  PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 724
  2⤵
  - Program crash
  PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 796
  2⤵
  - Program crash
  PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 772
  2⤵
  - Program crash
  PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 804
  2⤵
  - Program crash
  PID:4672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 816
  2⤵
  - Program crash
  PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 832
  2⤵
  - Program crash
  PID:2816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 824
  2⤵
  - Program crash
  PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 796
  2⤵
  - Program crash
  PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 816
  2⤵
  - Program crash
  PID:3452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 832
  2⤵
  - Program crash
  PID:280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 840
  2⤵
  - Program crash
  PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 860
  2⤵
  - Program crash
  PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 880
  2⤵
  - Program crash
  PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 896
  2⤵
  - Program crash
  PID:3304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 904
  2⤵
  - Program crash
  PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 844
  2⤵
  - Program crash
  PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 840
  2⤵
  - Program crash
  PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 872
  2⤵
  - Program crash
  PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 848
  2⤵
  - Program crash
  PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 828
  2⤵
  - Program crash
  PID:416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 964
  2⤵
  - Program crash
  PID:6084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 984
  2⤵
  - Program crash
  PID:5888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 956
  2⤵
  - Program crash
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 976
  2⤵
  - Program crash
  PID:5876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1008
  2⤵
  - Program crash
  PID:5716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 840
  2⤵
  - Program crash
  PID:7532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 904
  2⤵
  - Program crash
  PID:6312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 828
  2⤵
  - Program crash
  PID:6384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 984
  2⤵
  - Program crash
  PID:6592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 924
  2⤵
  - Program crash
  PID:6648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 996
  2⤵
  - Program crash
  PID:6496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 876
  2⤵
  - Program crash
  PID:5416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 840
  2⤵
  - Program crash
  PID:6776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 984
  2⤵
  - Program crash
  PID:7648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 884
  2⤵
  - Program crash
  PID:6692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 816
  2⤵
  - Program crash
  PID:6800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 856
  2⤵
  - Program crash
  PID:7044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 964
  2⤵
  - Program crash
  PID:7908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 876
  2⤵
  - Program crash
  PID:4140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1020
  2⤵
  - Program crash
  PID:6264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1016
  2⤵
  - Program crash
  PID:7712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 904
  2⤵
  - Program crash
  PID:7328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 976
  2⤵
  - Program crash
  PID:7188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1012
  2⤵
  - Program crash
  PID:5228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 708
  2⤵
  - Program crash
  PID:6060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 972
  2⤵
  - Program crash
  PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 872
  2⤵
  - Program crash
  PID:5248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 816
  2⤵
  - Program crash
  PID:6684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 852
  2⤵
  - Program crash
  PID:7636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 924
  2⤵
  - Program crash
  PID:6152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 900
  2⤵
  - Program crash
  PID:5592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 944
  2⤵
  - Program crash
  PID:7500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 984
  2⤵
  - Program crash
  PID:6740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1008
  2⤵
  - Program crash
  PID:3868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 832
  2⤵
  PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 912
  2⤵
  PID:5128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 720
  2⤵
  PID:8184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 724
  2⤵
  PID:7800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 720
  2⤵
  PID:5352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 888
  2⤵
  PID:6712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 832
  2⤵
  PID:7924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 920
  2⤵
  PID:8096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 808
  2⤵
  PID:2452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 972
  2⤵
  PID:6368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1004
  2⤵
  PID:5824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 628
  2⤵
  PID:4760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 808
  2⤵
  PID:3280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 712
  2⤵
  PID:3780
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:6800
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:7204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 984
  2⤵
  PID:6552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1168
  2⤵
  PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1064
  2⤵
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1320
  2⤵
  PID:7164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1360
  2⤵
  PID:5104
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:5892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1288
  2⤵
  PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 880
  2⤵
  PID:5288
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:7536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1064
  2⤵
  PID:8112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1388
  2⤵
  PID:8016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5084 -ip 5084
1⤵
PID:4500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5084 -ip 5084
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5084 -ip 5084
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5084 -ip 5084
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5084 -ip 5084
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5084 -ip 5084
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5084 -ip 5084
1⤵
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5084 -ip 5084
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5084 -ip 5084
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5084 -ip 5084
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5084 -ip 5084
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5084 -ip 5084
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5084 -ip 5084
1⤵
PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5084 -ip 5084
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5084 -ip 5084
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5084 -ip 5084
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5084 -ip 5084
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5084 -ip 5084
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5084 -ip 5084
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5084 -ip 5084
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 5084
1⤵
PID:304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5084 -ip 5084
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5084 -ip 5084
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5084 -ip 5084
1⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5084 -ip 5084
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5084 -ip 5084
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5084 -ip 5084
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5084 -ip 5084
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5084 -ip 5084
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5084 -ip 5084
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5084 -ip 5084
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5084 -ip 5084
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5084 -ip 5084
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5084 -ip 5084
1⤵
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5084 -ip 5084
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5084 -ip 5084
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5084 -ip 5084
1⤵
PID:6576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5084 -ip 5084
1⤵
PID:6784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5084 -ip 5084
1⤵
PID:6924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5084 -ip 5084
1⤵
PID:6632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5084 -ip 5084
1⤵
PID:6488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5084 -ip 5084
1⤵
PID:6516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5084 -ip 5084
1⤵
PID:6992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5084 -ip 5084
1⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5084 -ip 5084
1⤵
PID:6672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5084 -ip 5084
1⤵
PID:6740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5084 -ip 5084
1⤵
PID:8024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5084 -ip 5084
1⤵
PID:268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5084 -ip 5084
1⤵
PID:7040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5084 -ip 5084
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5084 -ip 5084
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5084 -ip 5084
1⤵
PID:6380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5084 -ip 5084
1⤵
PID:7440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5084 -ip 5084
1⤵
PID:6196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5084 -ip 5084
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5084 -ip 5084
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 5084
1⤵
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5084 -ip 5084
1⤵
PID:8124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5084 -ip 5084
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5084 -ip 5084
1⤵
PID:8148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 5084
1⤵
PID:7448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5084 -ip 5084
1⤵
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5084 -ip 5084
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5084 -ip 5084
1⤵
PID:6400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5084 -ip 5084
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5084 -ip 5084
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5084 -ip 5084
1⤵
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5084 -ip 5084
1⤵
PID:7980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5084 -ip 5084
1⤵
PID:6612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5084 -ip 5084
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5084 -ip 5084
1⤵
PID:6380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5084 -ip 5084
1⤵
PID:7568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5084 -ip 5084
1⤵
PID:6928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5084 -ip 5084
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5084 -ip 5084
1⤵
PID:6980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5084 -ip 5084
1⤵
PID:7428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5084 -ip 5084
1⤵
PID:6596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5084 -ip 5084
1⤵
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5084 -ip 5084
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5084 -ip 5084
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5084 -ip 5084
1⤵
PID:7488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5084 -ip 5084
1⤵
PID:5456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5084 -ip 5084
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5084 -ip 5084
1⤵
PID:7524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5084 -ip 5084
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5084 -ip 5084
1⤵
PID:6152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5084 -ip 5084
1⤵
PID:6684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\javafx-src.zip.id-1B20934B.[[email protected]].money

Filesize
5.7MB

MD5
417793c3b53b84688f0af45297aa2c2c

SHA1
c479981158f63e3817f6d26469bb2f10df9b5a32

SHA256
c55b01ac5c432d10044d4a002dfa720c32c436263d14df41f002d28a75b77ccb

SHA512
9e9747e8d1a312ddfd2ae95112012b17a61b2e376faa83740a140539a49460ccfeae43a27cc0dacf98ed601544ebc39c66460ee475a3500931677d34ea58e90b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
fad80d57dde89eee31cd6187077c5205

SHA1
94b0da70da2877befdafa84f0514ce22e4afba6c

SHA256
c21810fbd993d29fd9155fc78a6688e9cde76dcf0025762771b999acbf80b766

SHA512
6fd660678f4c91899c8f82859e8caba128293e25a200c4a090c3e72b0a4f7b4395df405504a462e55ec5248aa91010bf01de847db69db438ca18a0e51265f1a1

Download Submit
memory/5084-1-0x0000000002670000-0x0000000002770000-memory.dmp

Filesize
1024KB

Download
memory/5084-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5084-6-0x0000000000400000-0x0000000002484000-memory.dmp

Filesize
32.5MB

Download
memory/5084-7-0x0000000002670000-0x0000000002770000-memory.dmp

Filesize
1024KB

Download
memory/5084-25-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5084-24-0x0000000000400000-0x0000000002484000-memory.dmp

Filesize
32.5MB

Download