dharma | 526b432752bac2edc49ee4a3cc2428f5d7249fa3afe66deba5d23e12e4bce68c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rack/e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
Size

300KB
MD5

26bf7c2ab048094e9a0c15368d1105ba
SHA1

b0946dd6abcab1fddc71e2308ffb4587e094b03d
SHA256

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d
SHA512

437746ac926442d99cd9fa1164749a7a798be780e21ef42d14b4cb55ff8109eae296da5d74df924bc78c8ce2dc78b867dde032c297461dbebb4df2f728e6148f
SSDEEP

6144:T6ckSlQncoC4x/B5eRc6w/QPgDEC0NpW6AvJF55yFW6:T6RPncohxf/YqECCzMRm

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message A74F7413 In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (529) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe = "C:\\Windows\\System32\\e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe"	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

Drops file in System32 directory 2 IoCs

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

description	ioc	Process
File created	C:\Windows\System32\e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Windows\System32\Info.hta	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

Drops file in Program Files directory 64 IoCs

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_2x.gif.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\7-Zip\7-zip.dll.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\SmallTile.scale-125.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\core_icons.png.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\ui-strings.js	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.winmd	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteMediumTile.scale-400.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\inline-error-1x.png.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoDev.png.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons.png.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\ui-strings.js.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-white_scale-100.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\ui-strings.js	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_sr-Latn.json	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\ui-strings.js	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileSmallSquare.scale-200.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\id-ID\View3d\3DViewerProductDescription-universal.xml	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-36_altform-colorize.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Studio.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\ieinstal.exe.mui	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_contrast-white.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-lightunplated_devicefamily-colorfulunplated.png	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ui-strings.js.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.id-A74F7413.[[email protected]].money	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4496	4188	WerFault.exe	82
684	4188	WerFault.exe	82
4568	4188	WerFault.exe	82
3496	4188	WerFault.exe	82
384	4188	WerFault.exe	82
4692	4188	WerFault.exe	82
1304	4188	WerFault.exe	82
3716	4188	WerFault.exe	82
828	4188	WerFault.exe	82
4960	4188	WerFault.exe	82
2100	4188	WerFault.exe	82
2552	4188	WerFault.exe	82
2900	4188	WerFault.exe	82
728	4188	WerFault.exe	82
2152	4188	WerFault.exe	82
536	4188	WerFault.exe	82
3060	4188	WerFault.exe	82
4692	4188	WerFault.exe	82
6088	4188	WerFault.exe	82
5056	4188	WerFault.exe	82
3548	4188	WerFault.exe	82
6368	4188	WerFault.exe	82
7104	4188	WerFault.exe	82
1084	4188	WerFault.exe	82
7408	4188	WerFault.exe	82
6892	4188	WerFault.exe	82
7364	4188	WerFault.exe	82
9024	4188	WerFault.exe	82
7764	4188	WerFault.exe	82
4004	4188	WerFault.exe	82
8100	4188	WerFault.exe	82
4852	4188	WerFault.exe	82
6460	4188	WerFault.exe	82
7600	4188	WerFault.exe	82
6072	4188	WerFault.exe	82
5412	4188	WerFault.exe	82
9004	4188	WerFault.exe	82
3904	4188	WerFault.exe	82
6220	4188	WerFault.exe	82
5292	4188	WerFault.exe	82
8976	4188	WerFault.exe	82
5056	4188	WerFault.exe	82
6948	4188	WerFault.exe	82
8400	4188	WerFault.exe	82
6824	4188	WerFault.exe	82
5528	4188	WerFault.exe	82
8132	4188	WerFault.exe	82
8772	4188	WerFault.exe	82
8708	4188	WerFault.exe	82
8216	4188	WerFault.exe	82
8896	4188	WerFault.exe	82
3716	4188	WerFault.exe	82
8292	4188	WerFault.exe	82
6928	4188	WerFault.exe	82
5720	4188	WerFault.exe	82
728	4188	WerFault.exe	82
1124	4188	WerFault.exe	82
6864	4188	WerFault.exe	82
532	4188	WerFault.exe	82
7612	4188	WerFault.exe	82
5224	4188	WerFault.exe	82
5156	4188	WerFault.exe	82
8712	4188	WerFault.exe	82
5976	4188	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exevssadmin.exe

pid	Process
1860	vssadmin.exe
4484	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

pid	Process
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description	pid	Process
Token: SeBackupPrivilege	1880	vssvc.exe
Token: SeRestorePrivilege	1880	vssvc.exe
Token: SeAuditPrivilege	1880	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.execmd.execmd.exe

description	pid	Process	procid_target
PID 4188 wrote to memory of 2164	4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	83
PID 4188 wrote to memory of 2164	4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	83
PID 2164 wrote to memory of 1052	2164	cmd.exe	87
PID 2164 wrote to memory of 1052	2164	cmd.exe	87
PID 2164 wrote to memory of 1860	2164	cmd.exe	89
PID 2164 wrote to memory of 1860	2164	cmd.exe	89
PID 4188 wrote to memory of 7768	4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	261
PID 4188 wrote to memory of 7768	4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	261
PID 7768 wrote to memory of 5232	7768	cmd.exe	264
PID 7768 wrote to memory of 5232	7768	cmd.exe	264
PID 7768 wrote to memory of 4484	7768	cmd.exe	266
PID 7768 wrote to memory of 4484	7768	cmd.exe	266
PID 4188 wrote to memory of 2976	4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	276
PID 4188 wrote to memory of 2976	4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	276
PID 4188 wrote to memory of 528	4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	281
PID 4188 wrote to memory of 528	4188	e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe	281

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Rack\e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
"C:\Users\Admin\AppData\Local\Temp\Rack\e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:1052
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 528
  2⤵
  - Program crash
  PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 536
  2⤵
  - Program crash
  PID:684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 564
  2⤵
  - Program crash
  PID:4568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 544
  2⤵
  - Program crash
  PID:3496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 540
  2⤵
  - Program crash
  PID:384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 592
  2⤵
  - Program crash
  PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 608
  2⤵
  - Program crash
  PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 648
  2⤵
  - Program crash
  PID:3716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 680
  2⤵
  - Program crash
  PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 744
  2⤵
  - Program crash
  PID:4960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 728
  2⤵
  - Program crash
  PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 796
  2⤵
  - Program crash
  PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 816
  2⤵
  - Program crash
  PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 804
  2⤵
  - Program crash
  PID:728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 852
  2⤵
  - Program crash
  PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 832
  2⤵
  - Program crash
  PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 840
  2⤵
  - Program crash
  PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 808
  2⤵
  - Program crash
  PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 848
  2⤵
  - Program crash
  PID:6088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1000
  2⤵
  - Program crash
  PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 852
  2⤵
  - Program crash
  PID:3548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 976
  2⤵
  - Program crash
  PID:6368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 800
  2⤵
  - Program crash
  PID:7104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1016
  2⤵
  - Program crash
  PID:1084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1016
  2⤵
  - Program crash
  PID:7408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 948
  2⤵
  - Program crash
  PID:6892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 664
  2⤵
  - Program crash
  PID:7364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 844
  2⤵
  - Program crash
  PID:9024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 924
  2⤵
  - Program crash
  PID:7764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 912
  2⤵
  - Program crash
  PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 908
  2⤵
  - Program crash
  PID:8100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 636
  2⤵
  - Program crash
  PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 824
  2⤵
  - Program crash
  PID:6460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 992
  2⤵
  - Program crash
  PID:7600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 756
  2⤵
  - Program crash
  PID:6072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 904
  2⤵
  - Program crash
  PID:5412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 856
  2⤵
  - Program crash
  PID:9004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 980
  2⤵
  - Program crash
  PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 992
  2⤵
  - Program crash
  PID:6220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 668
  2⤵
  - Program crash
  PID:5292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 964
  2⤵
  - Program crash
  PID:8976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 836
  2⤵
  - Program crash
  PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 880
  2⤵
  - Program crash
  PID:6948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 796
  2⤵
  - Program crash
  PID:8400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 980
  2⤵
  - Program crash
  PID:6824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 836
  2⤵
  - Program crash
  PID:5528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 804
  2⤵
  - Program crash
  PID:8132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 796
  2⤵
  - Program crash
  PID:8772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 900
  2⤵
  - Program crash
  PID:8708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 836
  2⤵
  - Program crash
  PID:8216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 804
  2⤵
  - Program crash
  PID:8896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 796
  2⤵
  - Program crash
  PID:3716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 880
  2⤵
  - Program crash
  PID:8292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 924
  2⤵
  - Program crash
  PID:6928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 964
  2⤵
  - Program crash
  PID:5720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 796
  2⤵
  - Program crash
  PID:728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 972
  2⤵
  - Program crash
  PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 820
  2⤵
  - Program crash
  PID:6864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 924
  2⤵
  - Program crash
  PID:532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 792
  2⤵
  - Program crash
  PID:7612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 880
  2⤵
  - Program crash
  PID:5224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 924
  2⤵
  - Program crash
  PID:5156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 980
  2⤵
  - Program crash
  PID:8712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1004
  2⤵
  - Program crash
  PID:5976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1016
  2⤵
  PID:5360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 792
  2⤵
  PID:6204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 820
  2⤵
  PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 796
  2⤵
  PID:6292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 972
  2⤵
  PID:6936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1004
  2⤵
  PID:544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 980
  2⤵
  PID:6944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 996
  2⤵
  PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 900
  2⤵
  PID:7212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 804
  2⤵
  PID:6768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 948
  2⤵
  PID:5884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 980
  2⤵
  PID:6728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 900
  2⤵
  PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 792
  2⤵
  PID:7244
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7768
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:5232
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 968
  2⤵
  PID:7016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1108
  2⤵
  PID:6160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1204
  2⤵
  PID:2464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1328
  2⤵
  PID:6916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1320
  2⤵
  PID:7584
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1288
  2⤵
  PID:7036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1096
  2⤵
  PID:8808
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  PID:528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1620
  2⤵
  PID:8484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1380
  2⤵
  PID:7284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4188 -ip 4188
1⤵
PID:372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4188 -ip 4188
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4188 -ip 4188
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4188 -ip 4188
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4188 -ip 4188
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4188 -ip 4188
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4188 -ip 4188
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4188 -ip 4188
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4188 -ip 4188
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4188 -ip 4188
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4188 -ip 4188
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4188 -ip 4188
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4188 -ip 4188
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4188 -ip 4188
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4188 -ip 4188
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4188 -ip 4188
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4188 -ip 4188
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4188 -ip 4188
1⤵
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4188 -ip 4188
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4188 -ip 4188
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4188 -ip 4188
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4188 -ip 4188
1⤵
PID:6588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4188 -ip 4188
1⤵
PID:8160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
1⤵
PID:7808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4188 -ip 4188
1⤵
PID:6904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4188 -ip 4188
1⤵
PID:7928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4188 -ip 4188
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4188 -ip 4188
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4188 -ip 4188
1⤵
PID:8168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4188 -ip 4188
1⤵
PID:6716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4188 -ip 4188
1⤵
PID:8812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
1⤵
PID:5148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4188 -ip 4188
1⤵
PID:8220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4188 -ip 4188
1⤵
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4188 -ip 4188
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4188 -ip 4188
1⤵
PID:9180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4188 -ip 4188
1⤵
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4188 -ip 4188
1⤵
PID:8492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4188 -ip 4188
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4188 -ip 4188
1⤵
PID:9080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4188 -ip 4188
1⤵
PID:8460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4188 -ip 4188
1⤵
PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4188 -ip 4188
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4188 -ip 4188
1⤵
PID:6800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4188 -ip 4188
1⤵
PID:8788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
1⤵
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4188 -ip 4188
1⤵
PID:8848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4188 -ip 4188
1⤵
PID:6512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4188 -ip 4188
1⤵
PID:8556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4188 -ip 4188
1⤵
PID:8348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4188 -ip 4188
1⤵
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4188 -ip 4188
1⤵
PID:8892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4188 -ip 4188
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4188 -ip 4188
1⤵
PID:6200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4188 -ip 4188
1⤵
PID:8596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4188 -ip 4188
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4188 -ip 4188
1⤵
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4188 -ip 4188
1⤵
PID:6892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4188 -ip 4188
1⤵
PID:7144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4188 -ip 4188
1⤵
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4188 -ip 4188
1⤵
PID:7556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4188 -ip 4188
1⤵
PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4188 -ip 4188
1⤵
PID:9188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4188 -ip 4188
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4188 -ip 4188
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4188 -ip 4188
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4188 -ip 4188
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4188 -ip 4188
1⤵
PID:8456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4188 -ip 4188
1⤵
PID:7524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4188 -ip 4188
1⤵
PID:5792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4188 -ip 4188
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4188 -ip 4188
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4188 -ip 4188
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4188 -ip 4188
1⤵
PID:6468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4188 -ip 4188
1⤵
PID:7364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4188 -ip 4188
1⤵
PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4188 -ip 4188
1⤵
PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4188 -ip 4188
1⤵
PID:8608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4188 -ip 4188
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4188 -ip 4188
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4188 -ip 4188
1⤵
PID:8924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4188 -ip 4188
1⤵
PID:7564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4188 -ip 4188
1⤵
PID:7868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\javafx-src.zip.id-A74F7413.[[email protected]].money

Filesize
5.7MB

MD5
12134bff5b62edbcd856c5552d26f6cb

SHA1
31f1d9f5251abc2d143d0ec0edeb27dcbfbda778

SHA256
47d5ae18ccb79a8d2e0716e0d456e642cb070e7466f8d4f6d8513d903b42fb99

SHA512
2699b621474447df20bd693e60411b947d99ffca68b9a6628085b73964c247b49df344ed6bbd9b395abe6e72159fe744b3e743e5539b0e14033922bfc0d520b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
90c59da843f2fff1820f050dbf8f8255

SHA1
db3409a2f6cd493cb540370634b7ba4fc8ded1e2

SHA256
7c597167206bd570f6814d23d34254cd3a283d8a2311efd8a1296455248dbe11

SHA512
ed8a951ee1251cedc7a9e79393399d75a4151ef484703bcc20d8c23bd3cb6f01dac2ad387a7b7a915f2cba14c93f8aa4feb8b223295fa4274b17674856c54a3f

Download Submit
memory/4188-1-0x00000000008C0000-0x00000000009C0000-memory.dmp

Filesize
1024KB

Download
memory/4188-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4188-3-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download
memory/4188-1327-0x00000000008C0000-0x00000000009C0000-memory.dmp

Filesize
1024KB

Download
memory/4188-1594-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4188-2390-0x0000000000400000-0x00000000005FB000-memory.dmp

Filesize
2.0MB

Download