Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 07:21
Static task
static1
Behavioral task
behavioral1
Sample
dharma.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
dharma.exe
Resource
win10v20210410
General
-
Target
dharma.exe
-
Size
70KB
-
MD5
d65c7db4797b4738e91d0a24444033a6
-
SHA1
b524a9b5a3abebbc04c068897b69515e5a1f26ac
-
SHA256
883162246c3d0a2c10e5c35a2a43ff444a24dbcf9e64dc5cc09009b9cd0ab48e
-
SHA512
aee796aaea06081d45dc0495a736d697fb6bd3ed8f34ca2efb8fff6919311942db3aeb196c56276ae048a018c9c0827d66e319362e3402dfadd4558bfa2c88e3
Malware Config
Extracted
C:\info.hta
maksimbockovskij315@gmail.com
maksimbockovskij@tuta.io
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1376 bcdedit.exe 648 bcdedit.exe 1556 bcdedit.exe 1528 bcdedit.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dharma.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ResizeAdd.tiff dharma.exe File opened for modification C:\Users\Admin\Pictures\ResolveGroup.tiff dharma.exe -
Drops startup file 3 IoCs
Processes:
dharma.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\dharma.exe dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dharma.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dharma = "C:\\Users\\Admin\\AppData\\Local\\dharma.exe" dharma.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\dharma = "C:\\Users\\Admin\\AppData\\Local\\dharma.exe" dharma.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
dharma.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P8HHGB03\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini dharma.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Videos\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Documents\desktop.ini dharma.exe File opened for modification C:\Users\Public\desktop.ini dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VFDYFLB4\desktop.ini dharma.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini dharma.exe File opened for modification C:\Program Files\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini dharma.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dharma.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSWAVY.WMF dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102984.WMF dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02264_.WMF dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\FAXEXT.ECF.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153305.WMF.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDCNCLS.ICO.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\TAB_ON.GIF dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105294.WMF dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01473_.WMF dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_COL.HXT.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382957.JPG dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\messageboxinfo.ico dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can32.clx dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\NUMERIC.JPG dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\PAPYRUS.ELM dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD06200_.WMF dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149627.WMF.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Blog.dotx dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKWord.dll.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties dharma.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.PPT dharma.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6B.GIF dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower.png dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMASTHD.DPV.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WPULQT98.POC.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ur.dll.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROGRAM.DPV.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2 dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif dharma.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01797_.WMF.id[AF029118-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 640 vssadmin.exe 1172 vssadmin.exe -
Processes:
mshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dharma.exepid process 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe 1652 dharma.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1476 vssvc.exe Token: SeRestorePrivilege 1476 vssvc.exe Token: SeAuditPrivilege 1476 vssvc.exe Token: SeIncreaseQuotaPrivilege 952 WMIC.exe Token: SeSecurityPrivilege 952 WMIC.exe Token: SeTakeOwnershipPrivilege 952 WMIC.exe Token: SeLoadDriverPrivilege 952 WMIC.exe Token: SeSystemProfilePrivilege 952 WMIC.exe Token: SeSystemtimePrivilege 952 WMIC.exe Token: SeProfSingleProcessPrivilege 952 WMIC.exe Token: SeIncBasePriorityPrivilege 952 WMIC.exe Token: SeCreatePagefilePrivilege 952 WMIC.exe Token: SeBackupPrivilege 952 WMIC.exe Token: SeRestorePrivilege 952 WMIC.exe Token: SeShutdownPrivilege 952 WMIC.exe Token: SeDebugPrivilege 952 WMIC.exe Token: SeSystemEnvironmentPrivilege 952 WMIC.exe Token: SeRemoteShutdownPrivilege 952 WMIC.exe Token: SeUndockPrivilege 952 WMIC.exe Token: SeManageVolumePrivilege 952 WMIC.exe Token: 33 952 WMIC.exe Token: 34 952 WMIC.exe Token: 35 952 WMIC.exe Token: SeIncreaseQuotaPrivilege 952 WMIC.exe Token: SeSecurityPrivilege 952 WMIC.exe Token: SeTakeOwnershipPrivilege 952 WMIC.exe Token: SeLoadDriverPrivilege 952 WMIC.exe Token: SeSystemProfilePrivilege 952 WMIC.exe Token: SeSystemtimePrivilege 952 WMIC.exe Token: SeProfSingleProcessPrivilege 952 WMIC.exe Token: SeIncBasePriorityPrivilege 952 WMIC.exe Token: SeCreatePagefilePrivilege 952 WMIC.exe Token: SeBackupPrivilege 952 WMIC.exe Token: SeRestorePrivilege 952 WMIC.exe Token: SeShutdownPrivilege 952 WMIC.exe Token: SeDebugPrivilege 952 WMIC.exe Token: SeSystemEnvironmentPrivilege 952 WMIC.exe Token: SeRemoteShutdownPrivilege 952 WMIC.exe Token: SeUndockPrivilege 952 WMIC.exe Token: SeManageVolumePrivilege 952 WMIC.exe Token: 33 952 WMIC.exe Token: 34 952 WMIC.exe Token: 35 952 WMIC.exe Token: SeIncreaseQuotaPrivilege 1156 WMIC.exe Token: SeSecurityPrivilege 1156 WMIC.exe Token: SeTakeOwnershipPrivilege 1156 WMIC.exe Token: SeLoadDriverPrivilege 1156 WMIC.exe Token: SeSystemProfilePrivilege 1156 WMIC.exe Token: SeSystemtimePrivilege 1156 WMIC.exe Token: SeProfSingleProcessPrivilege 1156 WMIC.exe Token: SeIncBasePriorityPrivilege 1156 WMIC.exe Token: SeCreatePagefilePrivilege 1156 WMIC.exe Token: SeBackupPrivilege 1156 WMIC.exe Token: SeRestorePrivilege 1156 WMIC.exe Token: SeShutdownPrivilege 1156 WMIC.exe Token: SeDebugPrivilege 1156 WMIC.exe Token: SeSystemEnvironmentPrivilege 1156 WMIC.exe Token: SeRemoteShutdownPrivilege 1156 WMIC.exe Token: SeUndockPrivilege 1156 WMIC.exe Token: SeManageVolumePrivilege 1156 WMIC.exe Token: 33 1156 WMIC.exe Token: 34 1156 WMIC.exe Token: 35 1156 WMIC.exe Token: SeIncreaseQuotaPrivilege 1156 WMIC.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
dharma.execmd.execmd.execmd.exedescription pid process target process PID 1652 wrote to memory of 1656 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 1656 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 1656 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 1656 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 1624 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 1624 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 1624 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 1624 1652 dharma.exe cmd.exe PID 1656 wrote to memory of 768 1656 cmd.exe netsh.exe PID 1656 wrote to memory of 768 1656 cmd.exe netsh.exe PID 1656 wrote to memory of 768 1656 cmd.exe netsh.exe PID 1624 wrote to memory of 1172 1624 cmd.exe vssadmin.exe PID 1624 wrote to memory of 1172 1624 cmd.exe vssadmin.exe PID 1624 wrote to memory of 1172 1624 cmd.exe vssadmin.exe PID 1656 wrote to memory of 1144 1656 cmd.exe netsh.exe PID 1656 wrote to memory of 1144 1656 cmd.exe netsh.exe PID 1656 wrote to memory of 1144 1656 cmd.exe netsh.exe PID 1624 wrote to memory of 952 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 952 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 952 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 1376 1624 cmd.exe bcdedit.exe PID 1624 wrote to memory of 1376 1624 cmd.exe bcdedit.exe PID 1624 wrote to memory of 1376 1624 cmd.exe bcdedit.exe PID 1624 wrote to memory of 648 1624 cmd.exe bcdedit.exe PID 1624 wrote to memory of 648 1624 cmd.exe bcdedit.exe PID 1624 wrote to memory of 648 1624 cmd.exe bcdedit.exe PID 1652 wrote to memory of 1288 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 1288 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 1288 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 1288 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 768 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 768 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 768 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 768 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 904 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 904 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 904 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 904 1652 dharma.exe mshta.exe PID 1652 wrote to memory of 780 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 780 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 780 1652 dharma.exe cmd.exe PID 1652 wrote to memory of 780 1652 dharma.exe cmd.exe PID 780 wrote to memory of 640 780 cmd.exe vssadmin.exe PID 780 wrote to memory of 640 780 cmd.exe vssadmin.exe PID 780 wrote to memory of 640 780 cmd.exe vssadmin.exe PID 780 wrote to memory of 1156 780 cmd.exe WMIC.exe PID 780 wrote to memory of 1156 780 cmd.exe WMIC.exe PID 780 wrote to memory of 1156 780 cmd.exe WMIC.exe PID 780 wrote to memory of 1556 780 cmd.exe bcdedit.exe PID 780 wrote to memory of 1556 780 cmd.exe bcdedit.exe PID 780 wrote to memory of 1556 780 cmd.exe bcdedit.exe PID 780 wrote to memory of 1528 780 cmd.exe bcdedit.exe PID 780 wrote to memory of 1528 780 cmd.exe bcdedit.exe PID 780 wrote to memory of 1528 780 cmd.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dharma.exe"C:\Users\Admin\AppData\Local\Temp\dharma.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dharma.exe"C:\Users\Admin\AppData\Local\Temp\dharma.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\info.htaMD5
7a2da289e38061b7879a6f10656db940
SHA139976dfb674a1931a25728c71432cf7039c21f3e
SHA256060c5768e0b00be91413ae8150143f7df2c73517deeccf56528a99bd4ea9a38d
SHA512fe852fcbe6c91bc6122fb4cd92485e5ffb2d78a1929f787c612ede3f8301d90b2135b9ad4fc5d49bca09c59aad9e6cc4bf4d36b8d00e427e072828c5059e1245
-
C:\info.htaMD5
7a2da289e38061b7879a6f10656db940
SHA139976dfb674a1931a25728c71432cf7039c21f3e
SHA256060c5768e0b00be91413ae8150143f7df2c73517deeccf56528a99bd4ea9a38d
SHA512fe852fcbe6c91bc6122fb4cd92485e5ffb2d78a1929f787c612ede3f8301d90b2135b9ad4fc5d49bca09c59aad9e6cc4bf4d36b8d00e427e072828c5059e1245
-
C:\users\public\desktop\info.htaMD5
7a2da289e38061b7879a6f10656db940
SHA139976dfb674a1931a25728c71432cf7039c21f3e
SHA256060c5768e0b00be91413ae8150143f7df2c73517deeccf56528a99bd4ea9a38d
SHA512fe852fcbe6c91bc6122fb4cd92485e5ffb2d78a1929f787c612ede3f8301d90b2135b9ad4fc5d49bca09c59aad9e6cc4bf4d36b8d00e427e072828c5059e1245
-
memory/640-76-0x0000000000000000-mapping.dmp
-
memory/648-71-0x0000000000000000-mapping.dmp
-
memory/768-64-0x0000000000000000-mapping.dmp
-
memory/768-66-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmpFilesize
8KB
-
memory/768-73-0x0000000000000000-mapping.dmp
-
memory/780-75-0x0000000000000000-mapping.dmp
-
memory/904-74-0x0000000000000000-mapping.dmp
-
memory/952-69-0x0000000000000000-mapping.dmp
-
memory/1144-67-0x0000000000000000-mapping.dmp
-
memory/1156-77-0x0000000000000000-mapping.dmp
-
memory/1172-65-0x0000000000000000-mapping.dmp
-
memory/1288-72-0x0000000000000000-mapping.dmp
-
memory/1376-70-0x0000000000000000-mapping.dmp
-
memory/1528-83-0x0000000000000000-mapping.dmp
-
memory/1556-82-0x0000000000000000-mapping.dmp
-
memory/1624-63-0x0000000000000000-mapping.dmp
-
memory/1652-60-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1656-62-0x0000000000000000-mapping.dmp