dharma | 526b432752bac2edc49ee4a3cc2428f5d7249fa3afe66deba5d23e12e4bce68c

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rack/023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
Size

314KB
MD5

35c571a5e2465bd7d7b8c3e3eca4eaed
SHA1

0e8ebcd8d1042a5f2d59c6439051dda41675e972
SHA256

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010
SHA512

7c609be2fd889297d02581a21fe2560873373feb95545d77b385317da434ee20688b8891bf3bc1394210cf75b89fd543d477b6a34a4dfa4c5ef86597c05ae69d
SSDEEP

6144:6/8wNshaGQ509fgkVrcfwUWVBD1+qoXzrpc2/woiWP+7z5+dC:rwyYGY01gkxEWVyj+WPWN

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 87649D80 In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (521) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe = "C:\\Windows\\System32\\023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe"	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

description	ioc	process
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

Drops file in System32 directory 2 IoCs

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

description	ioc	process
File created	C:\Windows\System32\023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Windows\System32\Info.hta	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

Drops file in Program Files directory 64 IoCs

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-125_contrast-high.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\WideTile.scale-200.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\ui-strings.js.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OFFREL.DLL	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.winmd	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-80.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\changelog.txt.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-100_contrast-white.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\move.svg.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons.png.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Describe.ps1	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-250.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-100.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.INF.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-white_scale-100.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_24.svg.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main-selector.css.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\libsmartscreen.dll.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-32_altform-unplated_contrast-black.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\export.svg	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\info.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\Microsoft.PackageManagement.resources.dll.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODBC.DLL.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL.DLL.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\onintlim.dll	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Lollipop.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupWideTile.scale-400.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-white.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.id-87649D80.[[email protected]].money	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1936	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
2720	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
400	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4736	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4976	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
1428	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
3724	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
3736	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
876	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
1316	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
1620	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
1108	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4560	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4304	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
3216	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
284	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
952	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4732	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5068	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
1476	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
3748	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4548	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
2748	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
1500	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4872	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
1964	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
1360	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5036	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
968	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5636	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5352	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
2596	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5604	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4516	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
6448	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5280	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5604	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
7056	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4788	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5780	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5772	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
116	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5944	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5708	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4132	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5300	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
2496	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
6068	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
7164	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5312	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
6608	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
6068	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
7072	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
6300	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
6688	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5576	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
7108	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
672	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
6504	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
7160	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4956	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5400	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
6652	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
5136	4016	WerFault.exe	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

4508 vssadmin.exe
708 vssadmin.exe

pid	process
4508	vssadmin.exe
708	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

pid	process
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2712 vssvc.exe
Token: SeRestorePrivilege 2712 vssvc.exe
Token: SeAuditPrivilege 2712 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	2712	vssvc.exe
Token: SeRestorePrivilege	2712	vssvc.exe
Token: SeAuditPrivilege	2712	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.execmd.execmd.exe

description	pid	process	target process
PID 4016 wrote to memory of 4752	4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	cmd.exe
PID 4016 wrote to memory of 4752	4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	cmd.exe
PID 4752 wrote to memory of 2952	4752	cmd.exe	mode.com
PID 4752 wrote to memory of 2952	4752	cmd.exe	mode.com
PID 4752 wrote to memory of 4508	4752	cmd.exe	vssadmin.exe
PID 4752 wrote to memory of 4508	4752	cmd.exe	vssadmin.exe
PID 4016 wrote to memory of 3504	4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	cmd.exe
PID 4016 wrote to memory of 3504	4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	cmd.exe
PID 3504 wrote to memory of 6532	3504	cmd.exe	mode.com
PID 3504 wrote to memory of 6532	3504	cmd.exe	mode.com
PID 3504 wrote to memory of 708	3504	cmd.exe	vssadmin.exe
PID 3504 wrote to memory of 708	3504	cmd.exe	vssadmin.exe
PID 4016 wrote to memory of 3384	4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	mshta.exe
PID 4016 wrote to memory of 3384	4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	mshta.exe
PID 4016 wrote to memory of 1824	4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	mshta.exe
PID 4016 wrote to memory of 1824	4016	023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe	mshta.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Rack\023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe
"C:\Users\Admin\AppData\Local\Temp\Rack\023f69ef6dae03563d033b53730b56c53cedcb376d253ada613fd98c9a9ee010.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:2952
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 528
  2⤵
  - Program crash
  PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 568
  2⤵
  - Program crash
  PID:2720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 564
  2⤵
  - Program crash
  PID:400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 528
  2⤵
  - Program crash
  PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 604
  2⤵
  - Program crash
  PID:4976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 620
  2⤵
  - Program crash
  PID:1428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 652
  2⤵
  - Program crash
  PID:3724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 696
  2⤵
  - Program crash
  PID:3736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 704
  2⤵
  - Program crash
  PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 712
  2⤵
  - Program crash
  PID:1316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 744
  2⤵
  - Program crash
  PID:1620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 796
  2⤵
  - Program crash
  PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 836
  2⤵
  - Program crash
  PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 860
  2⤵
  - Program crash
  PID:4304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 868
  2⤵
  - Program crash
  PID:3216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 816
  2⤵
  - Program crash
  PID:284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 852
  2⤵
  - Program crash
  PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 712
  2⤵
  - Program crash
  PID:4732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 856
  2⤵
  - Program crash
  PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 876
  2⤵
  - Program crash
  PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 796
  2⤵
  - Program crash
  PID:3748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 856
  2⤵
  - Program crash
  PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 892
  2⤵
  - Program crash
  PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 912
  2⤵
  - Program crash
  PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 928
  2⤵
  - Program crash
  PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 920
  2⤵
  - Program crash
  PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 944
  2⤵
  - Program crash
  PID:1360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 952
  2⤵
  - Program crash
  PID:5036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 996
  2⤵
  - Program crash
  PID:968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 964
  2⤵
  - Program crash
  PID:5636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 840
  2⤵
  - Program crash
  PID:5352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 856
  2⤵
  - Program crash
  PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 900
  2⤵
  - Program crash
  PID:5604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 956
  2⤵
  - Program crash
  PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 976
  2⤵
  - Program crash
  PID:6448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 796
  2⤵
  - Program crash
  PID:5280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 960
  2⤵
  - Program crash
  PID:5604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 892
  2⤵
  - Program crash
  PID:7056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 848
  2⤵
  - Program crash
  PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 880
  2⤵
  - Program crash
  PID:5780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 876
  2⤵
  - Program crash
  PID:5772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 908
  2⤵
  - Program crash
  PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1004
  2⤵
  - Program crash
  PID:5944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1016
  2⤵
  - Program crash
  PID:5708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 912
  2⤵
  - Program crash
  PID:4132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 952
  2⤵
  - Program crash
  PID:5300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 836
  2⤵
  - Program crash
  PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 912
  2⤵
  - Program crash
  PID:6068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1016
  2⤵
  - Program crash
  PID:7164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 908
  2⤵
  - Program crash
  PID:5312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 916
  2⤵
  - Program crash
  PID:6608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 848
  2⤵
  - Program crash
  PID:6068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 880
  2⤵
  - Program crash
  PID:7072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 916
  2⤵
  - Program crash
  PID:6300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 992
  2⤵
  - Program crash
  PID:6688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 948
  2⤵
  - Program crash
  PID:5576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 996
  2⤵
  - Program crash
  PID:7108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 908
  2⤵
  - Program crash
  PID:672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 888
  2⤵
  - Program crash
  PID:6504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 964
  2⤵
  - Program crash
  PID:7160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 956
  2⤵
  - Program crash
  PID:4956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 856
  2⤵
  - Program crash
  PID:5400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 996
  2⤵
  - Program crash
  PID:6652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 944
  2⤵
  - Program crash
  PID:5136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 784
  2⤵
  PID:6324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 740
  2⤵
  PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 900
  2⤵
  PID:6920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 996
  2⤵
  PID:6380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1012
  2⤵
  PID:7040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 880
  2⤵
  PID:6704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 956
  2⤵
  PID:300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 712
  2⤵
  PID:3328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 780
  2⤵
  PID:5716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 844
  2⤵
  PID:4216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 948
  2⤵
  PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 936
  2⤵
  PID:5496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 956
  2⤵
  PID:3724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 836
  2⤵
  PID:1536
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:6532
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 932
  2⤵
  PID:6896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1064
  2⤵
  PID:400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 776
  2⤵
  PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1320
  2⤵
  PID:6676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1340
  2⤵
  PID:6920
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:3384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1300
  2⤵
  PID:6232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1084
  2⤵
  PID:4932
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:1824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1080
  2⤵
  PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1388
  2⤵
  PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4016 -ip 4016
1⤵
PID:4876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4016 -ip 4016
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4016 -ip 4016
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4016 -ip 4016
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4016 -ip 4016
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4016 -ip 4016
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4016 -ip 4016
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4016 -ip 4016
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4016 -ip 4016
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4016 -ip 4016
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4016 -ip 4016
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4016 -ip 4016
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4016 -ip 4016
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4016 -ip 4016
1⤵
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4016 -ip 4016
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4016 -ip 4016
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4016 -ip 4016
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4016 -ip 4016
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4016 -ip 4016
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4016 -ip 4016
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4016 -ip 4016
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4016 -ip 4016
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4016 -ip 4016
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4016 -ip 4016
1⤵
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4016 -ip 4016
1⤵
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4016 -ip 4016
1⤵
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4016 -ip 4016
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4016 -ip 4016
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4016 -ip 4016
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4016 -ip 4016
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4016 -ip 4016
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4016 -ip 4016
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4016 -ip 4016
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4016 -ip 4016
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4016 -ip 4016
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4016 -ip 4016
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4016 -ip 4016
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4016 -ip 4016
1⤵
PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4016 -ip 4016
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4016 -ip 4016
1⤵
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4016 -ip 4016
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4016 -ip 4016
1⤵
PID:6452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4016 -ip 4016
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4016 -ip 4016
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4016 -ip 4016
1⤵
PID:5792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4016 -ip 4016
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4016 -ip 4016
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4016 -ip 4016
1⤵
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4016 -ip 4016
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4016 -ip 4016
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4016 -ip 4016
1⤵
PID:6808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4016 -ip 4016
1⤵
PID:6732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4016 -ip 4016
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4016 -ip 4016
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4016 -ip 4016
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4016 -ip 4016
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4016 -ip 4016
1⤵
PID:292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4016 -ip 4016
1⤵
PID:7092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4016 -ip 4016
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4016 -ip 4016
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4016 -ip 4016
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4016 -ip 4016
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4016 -ip 4016
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4016 -ip 4016
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4016 -ip 4016
1⤵
PID:6956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4016 -ip 4016
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4016 -ip 4016
1⤵
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4016 -ip 4016
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4016 -ip 4016
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4016 -ip 4016
1⤵
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4016 -ip 4016
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4016 -ip 4016
1⤵
PID:5816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4016 -ip 4016
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4016 -ip 4016
1⤵
PID:5764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4016 -ip 4016
1⤵
PID:5128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4016 -ip 4016
1⤵
PID:7004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4016 -ip 4016
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4016 -ip 4016
1⤵
PID:6768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4016 -ip 4016
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4016 -ip 4016
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4016 -ip 4016
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4016 -ip 4016
1⤵
PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4016 -ip 4016
1⤵
PID:6388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4016 -ip 4016
1⤵
PID:6372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4016 -ip 4016
1⤵
PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4016 -ip 4016
1⤵
PID:6756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4016 -ip 4016
1⤵
PID:292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\javafx-src.zip.id-87649D80.[[email protected]].money

Filesize
5.7MB

MD5
6ef6eb967e6b721fc87f8ca35a5a5577

SHA1
ed3ef8b840626df2377eb07b6b4253bcd1154007

SHA256
f45303684f545c21c2288ad2667ee540a34d033c1e14a440bfd80651b8867ea0

SHA512
53e7f2968f763f9cd9200e5bf00aa06ffcc12fe22879048634e09748526fc1cfb48d7b5c0441175c563f3c42110718edbad87afa94b9aed4fac1a7a163327bfb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
6eee18174347f3e85c886ff0820f5af4

SHA1
18e23900d6c042c9a0ad3db50a88de30e5504ffe

SHA256
e3f5a26c3d18017e3d1af1f0bc42488bea469c4a0fe4adff7b429932adfdcfb6

SHA512
f72ddf9fee1baffd33542e81ad9a7a744890515b6d84d5b247abe861b65648b0db31828a433c40fa5ebf6208a1bac634003ac8c57cf74def362db0ee02c99c5b

Download Submit
memory/4016-1-0x0000000000650000-0x0000000000750000-memory.dmp

Filesize
1024KB

Download
memory/4016-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4016-4-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/4016-7-0x0000000000650000-0x0000000000750000-memory.dmp

Filesize
1024KB

Download
memory/4016-313-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4016-1130-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download