Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 17:32
Static task
static1
Behavioral task
behavioral1
Sample
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe
Resource
win10v2004-20241007-en
General
-
Target
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe
-
Size
92KB
-
MD5
627c54e435c997f228937d70fa4efabe
-
SHA1
de983ae81197370c1c0db019e47367ef0521163d
-
SHA256
1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1
-
SHA512
c827d16c316ba46e5ed73018a73dc99c2e62a0c809aeb986027444a1d5d53e4c3fcb955152debc30bc69c82621eeb6ec454d6add17e5b2875cf3d25e325f0466
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AYCKkjEvPSFd3tsEodcSDR:Qw+asqN5aW/hLKFPUJc
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe = "C:\\Windows\\System32\\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe" 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\4FXYHFK9\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Music\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Videos\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JFE2I4S\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JEDNWX6E\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IJMS2YBB\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Windows\System32\Info.hta 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14531_.GIF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Slipstream.thmx 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01252_.WMF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Java\jre7\lib\zi\America\Halifax.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02048_.WMF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185774.WMF 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginReport.Dotx 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185842.WMF 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8B.GIF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00170_.GIF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217262.WMF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POST98SP.POC 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\THMBNAIL.PNG.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02270_.WMF 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MCPS.DLL.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18233_.WMF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105496.WMF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0298897.WMF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_h.png 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\7-Zip\Lang\mn.txt.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00272_.WMF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32B.GIF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-D5EF85BE.[[email protected]].ROGER 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1152 vssadmin.exe 3588 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2052 vssvc.exe Token: SeRestorePrivilege 2052 vssvc.exe Token: SeAuditPrivilege 2052 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2108 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 30 PID 2640 wrote to memory of 2108 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 30 PID 2640 wrote to memory of 2108 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 30 PID 2640 wrote to memory of 2108 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 30 PID 2108 wrote to memory of 2808 2108 cmd.exe 32 PID 2108 wrote to memory of 2808 2108 cmd.exe 32 PID 2108 wrote to memory of 2808 2108 cmd.exe 32 PID 2108 wrote to memory of 1152 2108 cmd.exe 33 PID 2108 wrote to memory of 1152 2108 cmd.exe 33 PID 2108 wrote to memory of 1152 2108 cmd.exe 33 PID 2640 wrote to memory of 1688 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 38 PID 2640 wrote to memory of 1688 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 38 PID 2640 wrote to memory of 1688 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 38 PID 2640 wrote to memory of 1688 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 38 PID 1688 wrote to memory of 1568 1688 cmd.exe 40 PID 1688 wrote to memory of 1568 1688 cmd.exe 40 PID 1688 wrote to memory of 1568 1688 cmd.exe 40 PID 1688 wrote to memory of 3588 1688 cmd.exe 41 PID 1688 wrote to memory of 3588 1688 cmd.exe 41 PID 1688 wrote to memory of 3588 1688 cmd.exe 41 PID 2640 wrote to memory of 3968 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 42 PID 2640 wrote to memory of 3968 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 42 PID 2640 wrote to memory of 3968 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 42 PID 2640 wrote to memory of 3968 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 42 PID 2640 wrote to memory of 2200 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 43 PID 2640 wrote to memory of 2200 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 43 PID 2640 wrote to memory of 2200 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 43 PID 2640 wrote to memory of 2200 2640 1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe 43 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe"C:\Users\Admin\AppData\Local\Temp\1eca4383fb0c1d2e92b9a0ef1e939643a0fefdb37b4519e731030197c7091ff1.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2808
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1152
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1568
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3588
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3968
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2200
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-D5EF85BE.[[email protected]].ROGER
Filesize23.5MB
MD5db7d1c8bdd5d289529a38b648b4fff65
SHA1d556eaa35840499542410d9bac3cd08207ff2058
SHA256d09e3529ff044c21044528545d992651cf8f5ef4dca06633f97427a6ac206b94
SHA512c4bee57baac6a0fe0192afd115eeeaed129ec7b8f270c81787f183adf1fbb8426c50381f541c8a9f62fa23f16e12d5ad3c4e7712be9f68020917dcb8caa4927a
-
Filesize
7KB
MD53d0c61b1dc71e36897635f22cbfaa405
SHA1e357927f05b1674431c3f1f1d1eb65422ecd3ce3
SHA2567632015fc0cc0dddd4179b540a0656bc9720480e8843bacde16bbcc9fc44bc84
SHA5123dd5a145f72e2dbb8bde710cb3af2c8aa9030a2de8b6e08eb8fce06a1cd69810e040fa704a4c0545b3cb7ae409831cd385d5e11986c754880e881d0b4e08a051