Analysis
-
max time kernel
150s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-11-2020 14:54
Static task
static1
Behavioral task
behavioral1
Sample
lkx111.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
lkx111.exe
Resource
win10v20201028
General
-
Target
lkx111.exe
-
Size
343KB
-
MD5
b02136776084bf44e9fb7cbed1f751f4
-
SHA1
0ebaadcf79d7cc91cbe393173e0884bf324f8d5c
-
SHA256
b40d600b7c44bf3200fd3d1ef2977432af3a27622c67df62f49d8e3b04c047d5
-
SHA512
d1488eaacd8fbca80c85f01203e0976047ad90079e0bb011d8a136bcb0373ee7bf60e76c441444e12b3f1cf62617ac0bbbc09152ee3671f1fad829d7377b4d11
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
pexdatax@gmail.com
https://tox.chat/download.html
http://pexdatax.com/
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
lkx111.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini lkx111.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta lkx111.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lkx111.exe lkx111.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
lkx111.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lkx111.exe = "C:\\Windows\\System32\\lkx111.exe" lkx111.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" lkx111.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" lkx111.exe -
Drops desktop.ini file(s) 77 IoCs
Processes:
lkx111.exedescription ioc process File opened for modification C:\Users\Public\Videos\desktop.ini lkx111.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini lkx111.exe File opened for modification C:\Program Files\desktop.ini lkx111.exe File opened for modification C:\Program Files (x86)\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini lkx111.exe File opened for modification C:\Users\Public\Downloads\desktop.ini lkx111.exe File opened for modification C:\Users\Public\Music\desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Links\desktop.ini lkx111.exe File opened for modification C:\Users\Public\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini lkx111.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Searches\desktop.ini lkx111.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini lkx111.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3825035466-2522850611-591511364-1000\desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Documents\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D08RECS3\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini lkx111.exe File opened for modification C:\Users\Public\Pictures\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Music\desktop.ini lkx111.exe File opened for modification C:\Users\Public\Desktop\desktop.ini lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RKGIF8TT\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini lkx111.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini lkx111.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8DDKLDOL\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini lkx111.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini lkx111.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini lkx111.exe File opened for modification C:\Users\Public\Libraries\desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXBH52U7\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Videos\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini lkx111.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini lkx111.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini lkx111.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini lkx111.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini lkx111.exe File opened for modification C:\Users\Public\Documents\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini lkx111.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini lkx111.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini lkx111.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini lkx111.exe -
Drops file in System32 directory 2 IoCs
Processes:
lkx111.exedescription ioc process File created C:\Windows\System32\lkx111.exe lkx111.exe File created C:\Windows\System32\Info.hta lkx111.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 27811 IoCs
Processes:
lkx111.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CG1606.WMF lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0298897.WMF lkx111.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBWZINT.REST.IDX_DLL.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.ELM.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\RPT2HTM4.XSL lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200521.WMF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft lkx111.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLPERF.INI.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00512_.WMF lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Executive.xml.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files\7-Zip\Lang\pt.txt.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0281904.WMF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03464_.WMF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00197_.WMF lkx111.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00217_.WMF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png lkx111.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Manila.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21308_.GIF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XLMACRO.CHM.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_ON.GIF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01154_.WMF lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEM.CFG lkx111.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FORM98.POC.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0287005.WMF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMaskRTL.bmp.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-TW.dll lkx111.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IMCONTACT.DLL lkx111.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lv.dll.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml lkx111.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382958.JPG lkx111.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01238_.GIF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImageMask.bmp.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103058.WMF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL086.XML.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\HEADER.GIF lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACTL.ICO.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099204.WMF.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip lkx111.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip.id-5B8D4232.[pexdatax@gmail.com].ROGER lkx111.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1464 vssadmin.exe 1800 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 247 IoCs
Processes:
lkx111.exepid process 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe 1924 lkx111.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 908 vssvc.exe Token: SeRestorePrivilege 908 vssvc.exe Token: SeAuditPrivilege 908 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
lkx111.execmd.execmd.exedescription pid process target process PID 1924 wrote to memory of 1648 1924 lkx111.exe cmd.exe PID 1924 wrote to memory of 1648 1924 lkx111.exe cmd.exe PID 1924 wrote to memory of 1648 1924 lkx111.exe cmd.exe PID 1924 wrote to memory of 1648 1924 lkx111.exe cmd.exe PID 1648 wrote to memory of 988 1648 cmd.exe mode.com PID 1648 wrote to memory of 988 1648 cmd.exe mode.com PID 1648 wrote to memory of 988 1648 cmd.exe mode.com PID 1648 wrote to memory of 1464 1648 cmd.exe vssadmin.exe PID 1648 wrote to memory of 1464 1648 cmd.exe vssadmin.exe PID 1648 wrote to memory of 1464 1648 cmd.exe vssadmin.exe PID 1924 wrote to memory of 2036 1924 lkx111.exe cmd.exe PID 1924 wrote to memory of 2036 1924 lkx111.exe cmd.exe PID 1924 wrote to memory of 2036 1924 lkx111.exe cmd.exe PID 1924 wrote to memory of 2036 1924 lkx111.exe cmd.exe PID 2036 wrote to memory of 1604 2036 cmd.exe mode.com PID 2036 wrote to memory of 1604 2036 cmd.exe mode.com PID 2036 wrote to memory of 1604 2036 cmd.exe mode.com PID 2036 wrote to memory of 1800 2036 cmd.exe vssadmin.exe PID 2036 wrote to memory of 1800 2036 cmd.exe vssadmin.exe PID 2036 wrote to memory of 1800 2036 cmd.exe vssadmin.exe PID 1924 wrote to memory of 1700 1924 lkx111.exe mshta.exe PID 1924 wrote to memory of 1700 1924 lkx111.exe mshta.exe PID 1924 wrote to memory of 1700 1924 lkx111.exe mshta.exe PID 1924 wrote to memory of 1700 1924 lkx111.exe mshta.exe PID 1924 wrote to memory of 1452 1924 lkx111.exe mshta.exe PID 1924 wrote to memory of 1452 1924 lkx111.exe mshta.exe PID 1924 wrote to memory of 1452 1924 lkx111.exe mshta.exe PID 1924 wrote to memory of 1452 1924 lkx111.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lkx111.exe"C:\Users\Admin\AppData\Local\Temp\lkx111.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
994b6ba4d402268a36a91ae598b8bcac
SHA1194dbab8a8bb1c9ac8f6f1b088db3fe6537850fa
SHA256219d32159a128c8c080899ae35563c82b4649144821964baa60a4aafe65838cf
SHA512fcf401e7475853c7c743e149bc551da026b7fdadec78333e5728b35e275875535220d4194cb9fd9fdfeb7fb50e04db82c56f609a70d93678728b7771d0b8e0ab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
994b6ba4d402268a36a91ae598b8bcac
SHA1194dbab8a8bb1c9ac8f6f1b088db3fe6537850fa
SHA256219d32159a128c8c080899ae35563c82b4649144821964baa60a4aafe65838cf
SHA512fcf401e7475853c7c743e149bc551da026b7fdadec78333e5728b35e275875535220d4194cb9fd9fdfeb7fb50e04db82c56f609a70d93678728b7771d0b8e0ab
-
memory/988-2-0x0000000000000000-mapping.dmp
-
memory/1452-8-0x0000000000000000-mapping.dmp
-
memory/1464-3-0x0000000000000000-mapping.dmp
-
memory/1548-11-0x000007FEF6270000-0x000007FEF64EA000-memory.dmpFilesize
2.5MB
-
memory/1604-5-0x0000000000000000-mapping.dmp
-
memory/1648-1-0x0000000000000000-mapping.dmp
-
memory/1700-7-0x0000000000000000-mapping.dmp
-
memory/1800-6-0x0000000000000000-mapping.dmp
-
memory/1924-0-0x0000000006140000-0x0000000006151000-memory.dmpFilesize
68KB
-
memory/2036-4-0x0000000000000000-mapping.dmp