dharma | 526b432752bac2edc49ee4a3cc2428f5d7249fa3afe66deba5d23e12e4bce68c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rack/73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
Size

271KB
MD5

9edb93f2c5f92e7b1a664c266347ad0b
SHA1

f50e7db97b67da6686ec113d3d7a82aac1c647b4
SHA256

73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e
SHA512

437afb8757696a05165c0df8a3c99e22ba9c9d213ad03a8f9153562669abb42cb9e57e15907073e2a3d7f0e4f3d3ff6ca7fe16bf2168c3f1b36993849b2d09d0
SSDEEP

6144:v0OiXvUOgT5UIp9+QF+wGonORR77vF70q2T:FifIpFiALT

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 8E2B2087 In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (521) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe = "C:\\Windows\\System32\\73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe"	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Public\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Windows\System32\Info.hta	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_24.svg.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\nexturl.ort.DATA	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\91.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-150.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\ui-strings.js.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotExist.snippets.ps1xml	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\PortalConnectCore.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-100_contrast-white.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\plugin.js	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\SearchEmail.png.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\NETWORK.ELM	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations_retina.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalMedTile.scale-125_contrast-black.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Scan_visual.svg.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\offlineStrings.js	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\ui-strings.js.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\en-US_female_TTS\platform_format.lua	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7cb.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ui-strings.js.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SmallTile.scale-100.png	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeNullOrEmpty.ps1	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons2x.png.id-8E2B2087.[[email protected]].bot	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
372	3344	WerFault.exe	82
4056	3344	WerFault.exe	82
3880	3344	WerFault.exe	82
4648	3344	WerFault.exe	82
3292	3344	WerFault.exe	82
1812	3344	WerFault.exe	82
4240	3344	WerFault.exe	82
2312	3344	WerFault.exe	82
2948	3344	WerFault.exe	82
2176	3344	WerFault.exe	82
3140	3344	WerFault.exe	82
4220	3344	WerFault.exe	82
760	3344	WerFault.exe	82
4260	3344	WerFault.exe	82
2372	3344	WerFault.exe	82
2096	3344	WerFault.exe	82
292	3344	WerFault.exe	82
4176	3344	WerFault.exe	82
2668	3344	WerFault.exe	82
5060	3344	WerFault.exe	82
4052	3344	WerFault.exe	82
1320	3344	WerFault.exe	82
3236	3344	WerFault.exe	82
3292	3344	WerFault.exe	82
1208	3344	WerFault.exe	82
3804	3344	WerFault.exe	82
3952	3344	WerFault.exe	82
4980	3344	WerFault.exe	82
3056	3344	WerFault.exe	82
5060	3344	WerFault.exe	82
6000	3344	WerFault.exe	82
5188	3344	WerFault.exe	82
2980	3344	WerFault.exe	82
3936	3344	WerFault.exe	82
1436	3344	WerFault.exe	82
1620	3344	WerFault.exe	82
5488	3344	WerFault.exe	82
5988	3344	WerFault.exe	82
6884	3344	WerFault.exe	82
3000	3344	WerFault.exe	82
6380	3344	WerFault.exe	82
6924	3344	WerFault.exe	82
1760	3344	WerFault.exe	82
4228	3344	WerFault.exe	82
640	3344	WerFault.exe	82
5468	3344	WerFault.exe	82
6972	3344	WerFault.exe	82
6640	3344	WerFault.exe	82
6384	3344	WerFault.exe	82
6260	3344	WerFault.exe	82
7068	3344	WerFault.exe	82
5664	3344	WerFault.exe	82
2720	3344	WerFault.exe	82
5984	3344	WerFault.exe	82
6284	3344	WerFault.exe	82
6092	3344	WerFault.exe	82
3740	3344	WerFault.exe	82
3164	3344	WerFault.exe	82
5780	3344	WerFault.exe	82
4800	3344	WerFault.exe	82
5200	3344	WerFault.exe	82
4276	3344	WerFault.exe	82
6600	3344	WerFault.exe	82
5552	3344	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
388	vssadmin.exe
5744	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1240	vssvc.exe
Token: SeRestorePrivilege	1240	vssvc.exe
Token: SeAuditPrivilege	1240	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 1852	3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	84
PID 3344 wrote to memory of 1852	3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	84
PID 1852 wrote to memory of 3312	1852	cmd.exe	88
PID 1852 wrote to memory of 3312	1852	cmd.exe	88
PID 1852 wrote to memory of 388	1852	cmd.exe	89
PID 1852 wrote to memory of 388	1852	cmd.exe	89
PID 3344 wrote to memory of 6456	3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	265
PID 3344 wrote to memory of 6456	3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	265
PID 6456 wrote to memory of 5420	6456	cmd.exe	269
PID 6456 wrote to memory of 5420	6456	cmd.exe	269
PID 6456 wrote to memory of 5744	6456	cmd.exe	270
PID 6456 wrote to memory of 5744	6456	cmd.exe	270
PID 3344 wrote to memory of 5208	3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	279
PID 3344 wrote to memory of 5208	3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	279
PID 3344 wrote to memory of 6292	3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	284
PID 3344 wrote to memory of 6292	3344	73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe	284

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Rack\73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe
"C:\Users\Admin\AppData\Local\Temp\Rack\73809e9329c76c069035ac65dd9645c87aee3459a0f62b0fab1a640b56b6a34e.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:3312
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 524
  2⤵
  - Program crash
  PID:372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 532
  2⤵
  - Program crash
  PID:4056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 580
  2⤵
  - Program crash
  PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 588
  2⤵
  - Program crash
  PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 600
  2⤵
  - Program crash
  PID:3292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 636
  2⤵
  - Program crash
  PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 664
  2⤵
  - Program crash
  PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 716
  2⤵
  - Program crash
  PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 756
  2⤵
  - Program crash
  PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 740
  2⤵
  - Program crash
  PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 776
  2⤵
  - Program crash
  PID:3140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 792
  2⤵
  - Program crash
  PID:4220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 804
  2⤵
  - Program crash
  PID:760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 812
  2⤵
  - Program crash
  PID:4260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 828
  2⤵
  - Program crash
  PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 692
  2⤵
  - Program crash
  PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 836
  2⤵
  - Program crash
  PID:292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 748
  2⤵
  - Program crash
  PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 704
  2⤵
  - Program crash
  PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 700
  2⤵
  - Program crash
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 804
  2⤵
  - Program crash
  PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 864
  2⤵
  - Program crash
  PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 912
  2⤵
  - Program crash
  PID:3236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 920
  2⤵
  - Program crash
  PID:3292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 932
  2⤵
  - Program crash
  PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 952
  2⤵
  - Program crash
  PID:3804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 868
  2⤵
  - Program crash
  PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 924
  2⤵
  - Program crash
  PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 912
  2⤵
  - Program crash
  PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 984
  2⤵
  - Program crash
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 988
  2⤵
  - Program crash
  PID:6000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 952
  2⤵
  - Program crash
  PID:5188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 976
  2⤵
  - Program crash
  PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 884
  2⤵
  - Program crash
  PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 956
  2⤵
  - Program crash
  PID:1436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 804
  2⤵
  - Program crash
  PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 844
  2⤵
  - Program crash
  PID:5488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 888
  2⤵
  - Program crash
  PID:5988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 892
  2⤵
  - Program crash
  PID:6884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 844
  2⤵
  - Program crash
  PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 740
  2⤵
  - Program crash
  PID:6380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 872
  2⤵
  - Program crash
  PID:6924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 928
  2⤵
  - Program crash
  PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 984
  2⤵
  - Program crash
  PID:4228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 952
  2⤵
  - Program crash
  PID:640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 864
  2⤵
  - Program crash
  PID:5468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 872
  2⤵
  - Program crash
  PID:6972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 916
  2⤵
  - Program crash
  PID:6640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 992
  2⤵
  - Program crash
  PID:6384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 880
  2⤵
  - Program crash
  PID:6260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 952
  2⤵
  - Program crash
  PID:7068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 856
  2⤵
  - Program crash
  PID:5664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 864
  2⤵
  - Program crash
  PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 800
  2⤵
  - Program crash
  PID:5984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 936
  2⤵
  - Program crash
  PID:6284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 928
  2⤵
  - Program crash
  PID:6092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 880
  2⤵
  - Program crash
  PID:3740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 908
  2⤵
  - Program crash
  PID:3164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 996
  2⤵
  - Program crash
  PID:5780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 900
  2⤵
  - Program crash
  PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 932
  2⤵
  - Program crash
  PID:5200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 908
  2⤵
  - Program crash
  PID:4276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 916
  2⤵
  - Program crash
  PID:6600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1016
  2⤵
  - Program crash
  PID:5552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 896
  2⤵
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 948
  2⤵
  PID:1292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 872
  2⤵
  PID:4276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 564
  2⤵
  PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 812
  2⤵
  PID:7060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 800
  2⤵
  PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 576
  2⤵
  PID:6928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 812
  2⤵
  PID:6800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 908
  2⤵
  PID:5684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 960
  2⤵
  PID:6468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1012
  2⤵
  PID:6476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 908
  2⤵
  PID:6000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1004
  2⤵
  PID:6136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1012
  2⤵
  PID:6844
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6456
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:5420
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 864
  2⤵
  PID:780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1096
  2⤵
  PID:5144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1252
  2⤵
  PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1324
  2⤵
  PID:276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1248
  2⤵
  PID:5864
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:5208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1316
  2⤵
  PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 548
  2⤵
  PID:2376
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:6292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1048
  2⤵
  PID:5876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1212
  2⤵
  PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3344 -ip 3344
1⤵
PID:1436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3344 -ip 3344
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3344 -ip 3344
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3344 -ip 3344
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3344 -ip 3344
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3344 -ip 3344
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3344 -ip 3344
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 348 -p 3344 -ip 3344
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3344 -ip 3344
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3344 -ip 3344
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3344 -ip 3344
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3344 -ip 3344
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3344 -ip 3344
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3344 -ip 3344
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3344 -ip 3344
1⤵
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3344 -ip 3344
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3344 -ip 3344
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3344 -ip 3344
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3344 -ip 3344
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3344 -ip 3344
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3344 -ip 3344
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3344 -ip 3344
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3344 -ip 3344
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3344 -ip 3344
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3344 -ip 3344
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3344 -ip 3344
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3344 -ip 3344
1⤵
PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3344 -ip 3344
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3344 -ip 3344
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3344 -ip 3344
1⤵
PID:680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3344 -ip 3344
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3344 -ip 3344
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3344 -ip 3344
1⤵
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3344 -ip 3344
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 348 -p 3344 -ip 3344
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3344 -ip 3344
1⤵
PID:6436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3344 -ip 3344
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3344 -ip 3344
1⤵
PID:6488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 348 -p 3344 -ip 3344
1⤵
PID:5716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3344 -ip 3344
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3344 -ip 3344
1⤵
PID:7048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3344 -ip 3344
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3344 -ip 3344
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3344 -ip 3344
1⤵
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3344 -ip 3344
1⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3344 -ip 3344
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3344 -ip 3344
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3344 -ip 3344
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3344 -ip 3344
1⤵
PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3344 -ip 3344
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3344 -ip 3344
1⤵
PID:6792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3344 -ip 3344
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3344 -ip 3344
1⤵
PID:6740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3344 -ip 3344
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3344 -ip 3344
1⤵
PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3344 -ip 3344
1⤵
PID:5976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3344 -ip 3344
1⤵
PID:6204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3344 -ip 3344
1⤵
PID:7104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3344 -ip 3344
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3344 -ip 3344
1⤵
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3344 -ip 3344
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3344 -ip 3344
1⤵
PID:6936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3344 -ip 3344
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3344 -ip 3344
1⤵
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3344 -ip 3344
1⤵
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3344 -ip 3344
1⤵
PID:6600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3344 -ip 3344
1⤵
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3344 -ip 3344
1⤵
PID:5212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3344 -ip 3344
1⤵
PID:6676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3344 -ip 3344
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3344 -ip 3344
1⤵
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 348 -p 3344 -ip 3344
1⤵
PID:6768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3344 -ip 3344
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3344 -ip 3344
1⤵
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3344 -ip 3344
1⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3344 -ip 3344
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3344 -ip 3344
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 348 -p 3344 -ip 3344
1⤵
PID:6956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\javafx-src.zip.id-8E2B2087.[[email protected]].bot

Filesize
5.7MB

MD5
af75c4087549907b5f9d12562a861b21

SHA1
043fd0a3313cc01585dd6f518549141c8e73477d

SHA256
a6f7ec38608758e427c28d23b17d9fb9c8a8f385720a52b2d0ea79fa62ccbdea

SHA512
182f1d9dac06043774aaae89f4eeb001f23e4e9bdb9123c845a1fc3f5b594ca347fa8d73840a3e29e0eea68aab20c14e37dab73cdd29e91d7c2ca2d921d5c4a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
a94c274484cfae079cd9460fd97d77a3

SHA1
bd89fb726696de73b61186665c22904f400341f4

SHA256
b67e8b046d350dae449d787212a91f51485c16f02ff69b30e313d7d86d66f8e1

SHA512
c7b04a9cf85fef7d044b8f92a4135c6cf6be238ec60ab9415682e87acfd762b66f91e830d78526c35dfd3385ef4067e97d7742109c73aaef36655b9992e0d24f

Download Submit
memory/3344-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Filesize
1.9MB

Download
memory/3344-2-0x00000000007F0000-0x00000000008F0000-memory.dmp

Filesize
1024KB

Download
memory/3344-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3344-3-0x0000000000750000-0x0000000000769000-memory.dmp

Filesize
100KB

Download
memory/3344-8-0x00000000007F0000-0x00000000008F0000-memory.dmp

Filesize
1024KB

Download
memory/3344-537-0x0000000000750000-0x0000000000769000-memory.dmp

Filesize
100KB

Download
memory/3344-1169-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3344-1166-0x0000000000400000-0x00000000005EB000-memory.dmp

Filesize
1.9MB

Download