Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
31-05-2021 00:36
Static task
static1
Behavioral task
behavioral1
Sample
program.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
program.exe
Resource
win10v20210408
General
-
Target
program.exe
-
Size
92KB
-
MD5
b2eff93d16267edd3817eee2a40c7eee
-
SHA1
8489a94af0c4b9a7fd53affd64a3357141995c3a
-
SHA256
d13c712deac973ddd3666c02b76e8c0f2f5a4291078b579e231cdb8f5554efb2
-
SHA512
8abc98b506e977cd7958ccedefdc783be016ef3482ada047584fa8edb73ac5cff87a46c644fbb9b10c2b790399b51a6768db4762f9e5069ca04182473fbc4a2d
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
rdphack@onionmail.org
freelurk@aol.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
program.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ProtectMove.tiff program.exe File opened for modification C:\Users\Admin\Pictures\SaveHide.tiff program.exe -
Drops startup file 5 IoCs
Processes:
program.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-2C587399.[rdphack@onionmail.org].rdp program.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta program.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.exe program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini program.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
program.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" program.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" program.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\program.exe = "C:\\Windows\\System32\\program.exe" program.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
program.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini program.exe File opened for modification C:\Users\Admin\Videos\desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini program.exe File opened for modification C:\Users\Admin\Links\desktop.ini program.exe File opened for modification C:\Users\Public\Music\desktop.ini program.exe File opened for modification C:\Users\Public\Videos\desktop.ini program.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini program.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini program.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini program.exe File opened for modification C:\Users\Public\Downloads\desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini program.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini program.exe File opened for modification C:\Users\Public\Documents\desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini program.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini program.exe File opened for modification C:\Users\Public\Desktop\desktop.ini program.exe File opened for modification C:\Program Files\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini program.exe File opened for modification C:\Users\Admin\Music\desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini program.exe File opened for modification C:\Program Files (x86)\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini program.exe File opened for modification C:\Users\Public\Pictures\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini program.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini program.exe File opened for modification C:\Users\Public\desktop.ini program.exe File opened for modification C:\Users\Public\Libraries\desktop.ini program.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini program.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini program.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini program.exe File opened for modification C:\Users\Admin\Searches\desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini program.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini program.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini program.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini program.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini program.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini program.exe File opened for modification C:\Users\Admin\Documents\desktop.ini program.exe -
Drops file in System32 directory 2 IoCs
Processes:
program.exedescription ioc process File created C:\Windows\System32\program.exe program.exe File created C:\Windows\System32\Info.hta program.exe -
Drops file in Program Files directory 64 IoCs
Processes:
program.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.id-2C587399.[rdphack@onionmail.org].rdp program.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_ellipses_selected.svg.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ko_135x40.svg.id-2C587399.[rdphack@onionmail.org].rdp program.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML program.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png program.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2_48x48x32.png program.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ui-strings.js.id-2C587399.[rdphack@onionmail.org].rdp program.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\ProjectionSpheric.scale-140.png program.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluCCFilesEmpty_180x180.svg program.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\bulldozer.3mf program.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll program.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms program.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-100.png program.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\PlayStore_icon.svg.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe program.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\eventlog_provider.dll.id-2C587399.[rdphack@onionmail.org].rdp program.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\Icons\freecell.png program.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms program.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\vcruntime140.dll.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll program.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.id-2C587399.[rdphack@onionmail.org].rdp program.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\dnsns.jar.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml program.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.id-2C587399.[rdphack@onionmail.org].rdp program.exe File created C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_it.jar.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1249_32x32x32.png program.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\3007_20x20x32.png program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\ui-strings.js program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-40_altform-unplated.png program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeMedTile.scale-200.png program.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-400.png program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\japanese_over.png.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\NOTICE program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-200.png program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeLinguistic.dll program.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.White@2x.png.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-60_altform-colorize.png program.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated.png program.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcp120.dll.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_radio_selected_18.svg.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\NotificationsExtensions.winmd program.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml program.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GameEnd\endGame_blue_up.png program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\EnsoUI\id_arrow.png program.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_radio_unselected_18.svg.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\New-Fixture.Tests.ps1 program.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.id-2C587399.[rdphack@onionmail.org].rdp program.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\12.jpg program.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js program.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 648 vssadmin.exe 3904 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
program.exepid process 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe 708 program.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 204 vssvc.exe Token: SeRestorePrivilege 204 vssvc.exe Token: SeAuditPrivilege 204 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
program.execmd.execmd.exedescription pid process target process PID 708 wrote to memory of 3916 708 program.exe cmd.exe PID 708 wrote to memory of 3916 708 program.exe cmd.exe PID 3916 wrote to memory of 656 3916 cmd.exe mode.com PID 3916 wrote to memory of 656 3916 cmd.exe mode.com PID 3916 wrote to memory of 648 3916 cmd.exe vssadmin.exe PID 3916 wrote to memory of 648 3916 cmd.exe vssadmin.exe PID 708 wrote to memory of 2252 708 program.exe cmd.exe PID 708 wrote to memory of 2252 708 program.exe cmd.exe PID 2252 wrote to memory of 3932 2252 cmd.exe mode.com PID 2252 wrote to memory of 3932 2252 cmd.exe mode.com PID 2252 wrote to memory of 3904 2252 cmd.exe vssadmin.exe PID 2252 wrote to memory of 3904 2252 cmd.exe vssadmin.exe PID 708 wrote to memory of 1688 708 program.exe mshta.exe PID 708 wrote to memory of 1688 708 program.exe mshta.exe PID 708 wrote to memory of 916 708 program.exe mshta.exe PID 708 wrote to memory of 916 708 program.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\program.exe"C:\Users\Admin\AppData\Local\Temp\program.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
7448243ba8fd083fb80f159ecd395a29
SHA1a2da5c6b02f3976d312f9cce7059a12e55f3da27
SHA25693b610de91f5a280e784da33df027dbda354272d2df600f693c838031d0d4513
SHA5124f44a7d92b3e3d85d730ed4d29cd1960e62d70b5ab9a478c7953731270a0041d1f143b292e89a5073d1947b0bd468873572368af5a045fa9c5d4c993923c79b4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
7448243ba8fd083fb80f159ecd395a29
SHA1a2da5c6b02f3976d312f9cce7059a12e55f3da27
SHA25693b610de91f5a280e784da33df027dbda354272d2df600f693c838031d0d4513
SHA5124f44a7d92b3e3d85d730ed4d29cd1960e62d70b5ab9a478c7953731270a0041d1f143b292e89a5073d1947b0bd468873572368af5a045fa9c5d4c993923c79b4
-
memory/648-116-0x0000000000000000-mapping.dmp
-
memory/656-115-0x0000000000000000-mapping.dmp
-
memory/916-121-0x0000000000000000-mapping.dmp
-
memory/1688-120-0x0000000000000000-mapping.dmp
-
memory/2252-117-0x0000000000000000-mapping.dmp
-
memory/3904-119-0x0000000000000000-mapping.dmp
-
memory/3916-114-0x0000000000000000-mapping.dmp
-
memory/3932-118-0x0000000000000000-mapping.dmp