Analysis
-
max time kernel
149s -
max time network
56s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-07-2021 22:46
Static task
static1
Behavioral task
behavioral1
Sample
zip2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
zip2.exe
Resource
win10v20210408
General
-
Target
zip2.exe
-
Size
92KB
-
MD5
0f2c4685932a74e8a7bd4733ceea0fcc
-
SHA1
51201bbf3d9b532d8882a4cda4fa40f35d093179
-
SHA256
b0817a23a0189f43f8ceeb9899ade839f07da58dcf5a522d563c15382fba305a
-
SHA512
c397d75914c49eba7725f886845aa8a6b02cfbbaef59f858507b0ebce836aafb9743bafd2f409097ec45eb68e0c333cfda0fc0607b37ddbbaca6c23e2f73d461
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
itteam122@aol.com
itteam122@techmail.info
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
zip2.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RemoveStart.tiff zip2.exe -
Drops startup file 5 IoCs
Processes:
zip2.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta zip2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zip2.exe zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini zip2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
zip2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" zip2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" zip2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zip2.exe = "C:\\Windows\\System32\\zip2.exe" zip2.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
zip2.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Documents\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Searches\desktop.ini zip2.exe File opened for modification C:\Users\Public\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Links\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VLFEZDK1\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini zip2.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini zip2.exe File opened for modification C:\Users\Public\Pictures\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2MTLR0RV\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini zip2.exe File opened for modification C:\Program Files\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini zip2.exe File opened for modification C:\Program Files (x86)\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AJ1NIV9I\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini zip2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\93PHUZFG\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQE06QBJ\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini zip2.exe File opened for modification C:\Users\Public\Downloads\desktop.ini zip2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Music\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini zip2.exe File opened for modification C:\Users\Public\Documents\desktop.ini zip2.exe File opened for modification C:\Users\Public\Videos\desktop.ini zip2.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini zip2.exe File opened for modification C:\Users\Public\Desktop\desktop.ini zip2.exe File opened for modification C:\Users\Public\Music\desktop.ini zip2.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini zip2.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2513283230-931923277-594887482-1000\desktop.ini zip2.exe -
Drops file in System32 directory 2 IoCs
Processes:
zip2.exedescription ioc process File created C:\Windows\System32\zip2.exe zip2.exe File created C:\Windows\System32\Info.hta zip2.exe -
Drops file in Program Files directory 64 IoCs
Processes:
zip2.exedescription ioc process File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF zip2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL054.XML zip2.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18198_.WMF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll zip2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf zip2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter_partly-cloudy.png zip2.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216874.WMF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Troll.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15057_.GIF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME08.CSS zip2.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml zip2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287415.WMF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.xml zip2.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sl.pak.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\THMBNAIL.PNG.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14655_.GIF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15276_.GIF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT zip2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Init.xsn.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FALL_01.MID.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLY98SP.POC.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.JPG.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01126_.WMF zip2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Sofia zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00296_.WMF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo zip2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Java\jre7\lib\zi\America\Tijuana.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGATNGET.XML.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt zip2.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01849_.WMF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01040_.WMF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ru.dll zip2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif zip2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar zip2.exe File created C:\Program Files\Mozilla Firefox\browser\blocklist.xml.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0171847.WMF.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0337280.JPG.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.id-7B587689.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac zip2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1792 vssadmin.exe 1872 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
zip2.exepid process 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe 2028 zip2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1692 vssvc.exe Token: SeRestorePrivilege 1692 vssvc.exe Token: SeAuditPrivilege 1692 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
zip2.execmd.execmd.exedescription pid process target process PID 2028 wrote to memory of 1396 2028 zip2.exe cmd.exe PID 2028 wrote to memory of 1396 2028 zip2.exe cmd.exe PID 2028 wrote to memory of 1396 2028 zip2.exe cmd.exe PID 2028 wrote to memory of 1396 2028 zip2.exe cmd.exe PID 1396 wrote to memory of 1756 1396 cmd.exe mode.com PID 1396 wrote to memory of 1756 1396 cmd.exe mode.com PID 1396 wrote to memory of 1756 1396 cmd.exe mode.com PID 1396 wrote to memory of 1792 1396 cmd.exe vssadmin.exe PID 1396 wrote to memory of 1792 1396 cmd.exe vssadmin.exe PID 1396 wrote to memory of 1792 1396 cmd.exe vssadmin.exe PID 2028 wrote to memory of 1940 2028 zip2.exe cmd.exe PID 2028 wrote to memory of 1940 2028 zip2.exe cmd.exe PID 2028 wrote to memory of 1940 2028 zip2.exe cmd.exe PID 2028 wrote to memory of 1940 2028 zip2.exe cmd.exe PID 2028 wrote to memory of 1056 2028 zip2.exe mshta.exe PID 2028 wrote to memory of 1056 2028 zip2.exe mshta.exe PID 2028 wrote to memory of 1056 2028 zip2.exe mshta.exe PID 2028 wrote to memory of 1056 2028 zip2.exe mshta.exe PID 1940 wrote to memory of 1840 1940 cmd.exe mode.com PID 1940 wrote to memory of 1840 1940 cmd.exe mode.com PID 1940 wrote to memory of 1840 1940 cmd.exe mode.com PID 1940 wrote to memory of 1872 1940 cmd.exe vssadmin.exe PID 1940 wrote to memory of 1872 1940 cmd.exe vssadmin.exe PID 1940 wrote to memory of 1872 1940 cmd.exe vssadmin.exe PID 2028 wrote to memory of 1316 2028 zip2.exe mshta.exe PID 2028 wrote to memory of 1316 2028 zip2.exe mshta.exe PID 2028 wrote to memory of 1316 2028 zip2.exe mshta.exe PID 2028 wrote to memory of 1316 2028 zip2.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zip2.exe"C:\Users\Admin\AppData\Local\Temp\zip2.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
a667d0dd110136eeffdb3a419df849a9
SHA1133b2c0328152e933266df049cefccb0fc513735
SHA2567cf58f2da464ae0fe289f951962052d489fed724d9d57d008a63984ab8543b2d
SHA512a7fdd9217c27e4cc0113fa9b86914e7e2d137a3c8b17a1298e9d3f09f5ef88d136e46525a05f907a12784172fd71d651832395298632367585956166352ca6c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
a667d0dd110136eeffdb3a419df849a9
SHA1133b2c0328152e933266df049cefccb0fc513735
SHA2567cf58f2da464ae0fe289f951962052d489fed724d9d57d008a63984ab8543b2d
SHA512a7fdd9217c27e4cc0113fa9b86914e7e2d137a3c8b17a1298e9d3f09f5ef88d136e46525a05f907a12784172fd71d651832395298632367585956166352ca6c8
-
memory/1056-66-0x0000000000000000-mapping.dmp
-
memory/1316-68-0x0000000000000000-mapping.dmp
-
memory/1316-69-0x000007FEFC411000-0x000007FEFC413000-memory.dmpFilesize
8KB
-
memory/1396-61-0x0000000000000000-mapping.dmp
-
memory/1756-62-0x0000000000000000-mapping.dmp
-
memory/1792-63-0x0000000000000000-mapping.dmp
-
memory/1840-65-0x0000000000000000-mapping.dmp
-
memory/1872-67-0x0000000000000000-mapping.dmp
-
memory/1940-64-0x0000000000000000-mapping.dmp
-
memory/2028-60-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB