Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-07-2021 07:21
Static task
static1
Behavioral task
behavioral1
Sample
dharma.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
dharma.exe
Resource
win10v20210410
General
-
Target
dharma.exe
-
Size
70KB
-
MD5
d65c7db4797b4738e91d0a24444033a6
-
SHA1
b524a9b5a3abebbc04c068897b69515e5a1f26ac
-
SHA256
883162246c3d0a2c10e5c35a2a43ff444a24dbcf9e64dc5cc09009b9cd0ab48e
-
SHA512
aee796aaea06081d45dc0495a736d697fb6bd3ed8f34ca2efb8fff6919311942db3aeb196c56276ae048a018c9c0827d66e319362e3402dfadd4558bfa2c88e3
Malware Config
Extracted
C:\users\public\desktop\info.hta
maksimbockovskij315@gmail.com
maksimbockovskij@tuta.io
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 1800 created 1864 1800 svchost.exe dharma.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 3008 bcdedit.exe 4008 bcdedit.exe 3224 bcdedit.exe 2032 bcdedit.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dharma.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\GrantSplit.tiff dharma.exe File opened for modification C:\Users\Admin\Pictures\RedoRemove.tiff dharma.exe -
Drops startup file 3 IoCs
Processes:
dharma.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\dharma.exe dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dharma.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dharma = "C:\\Users\\Admin\\AppData\\Local\\dharma.exe" dharma.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\dharma = "C:\\Users\\Admin\\AppData\\Local\\dharma.exe" dharma.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
dharma.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini dharma.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini dharma.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\Videos\desktop.ini dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Documents\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini dharma.exe File opened for modification C:\Users\Public\desktop.ini dharma.exe File opened for modification C:\Program Files\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini dharma.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini dharma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini dharma.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dharma.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsWideTile.scale-100.png dharma.exe File created C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\WideTile.scale-125.png dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_radio_unselected_18.svg dharma.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\_Resources\index.txt dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2653_48x48x32.png dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\LargeTile.scale-100.png dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-150_contrast-white.png dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\SmallTile.scale-125.png dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-32.png dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\ui-strings.js.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\FullScreen\FullScreen.png dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms dharma.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\hyph_en_US.dic dharma.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-150.png dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\osf\dropdownarrow_16x16x32.png dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36.png dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js dharma.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-125.png dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main.css.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-150_8wekyb3d8bbwe\resources.pri dharma.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeGreaterThan.snippets.ps1xml dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png dharma.exe File created C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\ui-strings.js dharma.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll dharma.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarLargeTile.scale-150.png dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\ui-strings.js dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Buttons\Deal\New-Deal-press.png dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\SpotlightMailHxS_2016-09.png dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\forms_poster.jpg.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf.png.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\PortalConnectCore.dll dharma.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\concrt140.dll.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\plugin.js dharma.exe File created C:\Program Files\VideoLAN\VLC\NEWS.txt.id[E880C011-2218].[maksimbockovskij315@gmail.com].Acton dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-100.png dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-200.png dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEEXCH.DLL dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\crying.png dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 3084 vssadmin.exe 728 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
dharma.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings dharma.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dharma.exepid process 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe 1864 dharma.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exevssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeTcbPrivilege 1800 svchost.exe Token: SeTcbPrivilege 1800 svchost.exe Token: SeBackupPrivilege 3856 vssvc.exe Token: SeRestorePrivilege 3856 vssvc.exe Token: SeAuditPrivilege 3856 vssvc.exe Token: SeIncreaseQuotaPrivilege 696 WMIC.exe Token: SeSecurityPrivilege 696 WMIC.exe Token: SeTakeOwnershipPrivilege 696 WMIC.exe Token: SeLoadDriverPrivilege 696 WMIC.exe Token: SeSystemProfilePrivilege 696 WMIC.exe Token: SeSystemtimePrivilege 696 WMIC.exe Token: SeProfSingleProcessPrivilege 696 WMIC.exe Token: SeIncBasePriorityPrivilege 696 WMIC.exe Token: SeCreatePagefilePrivilege 696 WMIC.exe Token: SeBackupPrivilege 696 WMIC.exe Token: SeRestorePrivilege 696 WMIC.exe Token: SeShutdownPrivilege 696 WMIC.exe Token: SeDebugPrivilege 696 WMIC.exe Token: SeSystemEnvironmentPrivilege 696 WMIC.exe Token: SeRemoteShutdownPrivilege 696 WMIC.exe Token: SeUndockPrivilege 696 WMIC.exe Token: SeManageVolumePrivilege 696 WMIC.exe Token: 33 696 WMIC.exe Token: 34 696 WMIC.exe Token: 35 696 WMIC.exe Token: 36 696 WMIC.exe Token: SeIncreaseQuotaPrivilege 696 WMIC.exe Token: SeSecurityPrivilege 696 WMIC.exe Token: SeTakeOwnershipPrivilege 696 WMIC.exe Token: SeLoadDriverPrivilege 696 WMIC.exe Token: SeSystemProfilePrivilege 696 WMIC.exe Token: SeSystemtimePrivilege 696 WMIC.exe Token: SeProfSingleProcessPrivilege 696 WMIC.exe Token: SeIncBasePriorityPrivilege 696 WMIC.exe Token: SeCreatePagefilePrivilege 696 WMIC.exe Token: SeBackupPrivilege 696 WMIC.exe Token: SeRestorePrivilege 696 WMIC.exe Token: SeShutdownPrivilege 696 WMIC.exe Token: SeDebugPrivilege 696 WMIC.exe Token: SeSystemEnvironmentPrivilege 696 WMIC.exe Token: SeRemoteShutdownPrivilege 696 WMIC.exe Token: SeUndockPrivilege 696 WMIC.exe Token: SeManageVolumePrivilege 696 WMIC.exe Token: 33 696 WMIC.exe Token: 34 696 WMIC.exe Token: 35 696 WMIC.exe Token: 36 696 WMIC.exe Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
svchost.exedharma.execmd.execmd.execmd.exedescription pid process target process PID 1800 wrote to memory of 2360 1800 svchost.exe dharma.exe PID 1800 wrote to memory of 2360 1800 svchost.exe dharma.exe PID 1800 wrote to memory of 2360 1800 svchost.exe dharma.exe PID 1864 wrote to memory of 3240 1864 dharma.exe cmd.exe PID 1864 wrote to memory of 3240 1864 dharma.exe cmd.exe PID 1864 wrote to memory of 780 1864 dharma.exe cmd.exe PID 1864 wrote to memory of 780 1864 dharma.exe cmd.exe PID 780 wrote to memory of 3224 780 cmd.exe netsh.exe PID 780 wrote to memory of 3224 780 cmd.exe netsh.exe PID 3240 wrote to memory of 3084 3240 cmd.exe vssadmin.exe PID 3240 wrote to memory of 3084 3240 cmd.exe vssadmin.exe PID 3240 wrote to memory of 696 3240 cmd.exe WMIC.exe PID 3240 wrote to memory of 696 3240 cmd.exe WMIC.exe PID 780 wrote to memory of 2384 780 cmd.exe netsh.exe PID 780 wrote to memory of 2384 780 cmd.exe netsh.exe PID 3240 wrote to memory of 3008 3240 cmd.exe bcdedit.exe PID 3240 wrote to memory of 3008 3240 cmd.exe bcdedit.exe PID 3240 wrote to memory of 4008 3240 cmd.exe bcdedit.exe PID 3240 wrote to memory of 4008 3240 cmd.exe bcdedit.exe PID 1864 wrote to memory of 264 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 264 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 264 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 388 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 388 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 388 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 3568 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 3568 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 3568 1864 dharma.exe mshta.exe PID 1864 wrote to memory of 3248 1864 dharma.exe cmd.exe PID 1864 wrote to memory of 3248 1864 dharma.exe cmd.exe PID 3248 wrote to memory of 728 3248 cmd.exe vssadmin.exe PID 3248 wrote to memory of 728 3248 cmd.exe vssadmin.exe PID 3248 wrote to memory of 1192 3248 cmd.exe WMIC.exe PID 3248 wrote to memory of 1192 3248 cmd.exe WMIC.exe PID 3248 wrote to memory of 3224 3248 cmd.exe bcdedit.exe PID 3248 wrote to memory of 3224 3248 cmd.exe bcdedit.exe PID 3248 wrote to memory of 2032 3248 cmd.exe bcdedit.exe PID 3248 wrote to memory of 2032 3248 cmd.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dharma.exe"C:\Users\Admin\AppData\Local\Temp\dharma.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dharma.exe"C:\Users\Admin\AppData\Local\Temp\dharma.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\info.htaMD5
8b86a86efb550c502be921fe127a8654
SHA119e86f2a62254d868960b5133de2837733f2dbf9
SHA2560b707adc7f511ca545d99fa652bf9482f20c019fb1a130252c39f04c7581c43c
SHA512e78bec34be46e0eb564319f8084d0e593467eba59402ed0779d76d05284f865455e0ec21cd038cf084182d31e36a029cd2f9eb04e30d6a9756f8b259ad1d0ed5
-
C:\info.htaMD5
8b86a86efb550c502be921fe127a8654
SHA119e86f2a62254d868960b5133de2837733f2dbf9
SHA2560b707adc7f511ca545d99fa652bf9482f20c019fb1a130252c39f04c7581c43c
SHA512e78bec34be46e0eb564319f8084d0e593467eba59402ed0779d76d05284f865455e0ec21cd038cf084182d31e36a029cd2f9eb04e30d6a9756f8b259ad1d0ed5
-
C:\users\public\desktop\info.htaMD5
8b86a86efb550c502be921fe127a8654
SHA119e86f2a62254d868960b5133de2837733f2dbf9
SHA2560b707adc7f511ca545d99fa652bf9482f20c019fb1a130252c39f04c7581c43c
SHA512e78bec34be46e0eb564319f8084d0e593467eba59402ed0779d76d05284f865455e0ec21cd038cf084182d31e36a029cd2f9eb04e30d6a9756f8b259ad1d0ed5
-
memory/264-123-0x0000000000000000-mapping.dmp
-
memory/388-124-0x0000000000000000-mapping.dmp
-
memory/696-119-0x0000000000000000-mapping.dmp
-
memory/728-130-0x0000000000000000-mapping.dmp
-
memory/780-116-0x0000000000000000-mapping.dmp
-
memory/1192-131-0x0000000000000000-mapping.dmp
-
memory/2032-133-0x0000000000000000-mapping.dmp
-
memory/2360-114-0x0000000000000000-mapping.dmp
-
memory/2384-120-0x0000000000000000-mapping.dmp
-
memory/3008-121-0x0000000000000000-mapping.dmp
-
memory/3084-118-0x0000000000000000-mapping.dmp
-
memory/3224-117-0x0000000000000000-mapping.dmp
-
memory/3224-132-0x0000000000000000-mapping.dmp
-
memory/3240-115-0x0000000000000000-mapping.dmp
-
memory/3248-126-0x0000000000000000-mapping.dmp
-
memory/3568-125-0x0000000000000000-mapping.dmp
-
memory/4008-122-0x0000000000000000-mapping.dmp