Analysis
-
max time kernel
151s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
24-07-2021 22:46
Static task
static1
Behavioral task
behavioral1
Sample
zip2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
zip2.exe
Resource
win10v20210408
General
-
Target
zip2.exe
-
Size
92KB
-
MD5
0f2c4685932a74e8a7bd4733ceea0fcc
-
SHA1
51201bbf3d9b532d8882a4cda4fa40f35d093179
-
SHA256
b0817a23a0189f43f8ceeb9899ade839f07da58dcf5a522d563c15382fba305a
-
SHA512
c397d75914c49eba7725f886845aa8a6b02cfbbaef59f858507b0ebce836aafb9743bafd2f409097ec45eb68e0c333cfda0fc0607b37ddbbaca6c23e2f73d461
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
itteam122@aol.com
itteam122@techmail.info
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
zip2.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SendRename.tiff zip2.exe File opened for modification C:\Users\Admin\Pictures\SyncExport.tiff zip2.exe -
Drops startup file 5 IoCs
Processes:
zip2.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini zip2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta zip2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zip2.exe zip2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
zip2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zip2.exe = "C:\\Windows\\System32\\zip2.exe" zip2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" zip2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" zip2.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
zip2.exedescription ioc process File opened for modification C:\Users\Public\AccountPictures\desktop.ini zip2.exe File opened for modification C:\Users\Public\desktop.ini zip2.exe File opened for modification C:\Users\Public\Music\desktop.ini zip2.exe File opened for modification C:\Users\Public\Videos\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\Searches\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI zip2.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini zip2.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini zip2.exe File opened for modification C:\Program Files\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Videos\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Music\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini zip2.exe File opened for modification C:\Users\Public\Desktop\desktop.ini zip2.exe File opened for modification C:\Users\Public\Pictures\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Documents\desktop.ini zip2.exe File opened for modification C:\Users\Public\Downloads\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini zip2.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini zip2.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini zip2.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini zip2.exe File opened for modification C:\Users\Public\Libraries\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini zip2.exe File opened for modification C:\Users\Public\Documents\desktop.ini zip2.exe File opened for modification C:\Program Files (x86)\desktop.ini zip2.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini zip2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini zip2.exe File opened for modification C:\Users\Admin\Links\desktop.ini zip2.exe -
Drops file in System32 directory 2 IoCs
Processes:
zip2.exedescription ioc process File created C:\Windows\System32\zip2.exe zip2.exe File created C:\Windows\System32\Info.hta zip2.exe -
Drops file in Program Files directory 64 IoCs
Processes:
zip2.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache-Dark.scale-180.png zip2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\next-arrow-hover.svg.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.INF.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt zip2.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\youtube.crx zip2.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-72.png zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\TEE\en-US.Calendar.ot zip2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\tv_16x11.png zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-synch-l1-2-0.dll.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sv-se\ui-strings.js.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXSLE.dll.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_altform-unplated_contrast-white.png zip2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll zip2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\ui-strings.js.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\ui-strings.js zip2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PREVIEW.GIF zip2.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\pencht.dll zip2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\LargeTile.scale-100.png zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\msvcp100.dll.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll zip2.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll zip2.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll zip2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign.png.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-200.png zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100_contrast-high.png zip2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-selector.js zip2.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_auditreport_18.svg.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\PREVIEW.GIF zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32.png zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe zip2.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Preview.scale-100_layoutdir-LTR.png zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\PaintSplashScreen.scale-200.png zip2.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\ro_16x11.png zip2.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-100.png zip2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar zip2.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreBadgeLogo.scale-100.png zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Styles.xbf zip2.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\PSReadline.psm1 zip2.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Describe.ps1 zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml zip2.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Awards\Assets\3_awards_years_base.png zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\ui-strings.js.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\RICEPAPR.ELM.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll.id-301C1E19.[itteam122@aol.com].ROGER zip2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV zip2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 4064 vssadmin.exe 2964 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
zip2.exepid process 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe 568 zip2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3736 vssvc.exe Token: SeRestorePrivilege 3736 vssvc.exe Token: SeAuditPrivilege 3736 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
zip2.execmd.execmd.exedescription pid process target process PID 568 wrote to memory of 4040 568 zip2.exe cmd.exe PID 568 wrote to memory of 4040 568 zip2.exe cmd.exe PID 4040 wrote to memory of 3800 4040 cmd.exe mode.com PID 4040 wrote to memory of 3800 4040 cmd.exe mode.com PID 4040 wrote to memory of 4064 4040 cmd.exe vssadmin.exe PID 4040 wrote to memory of 4064 4040 cmd.exe vssadmin.exe PID 568 wrote to memory of 3236 568 zip2.exe cmd.exe PID 568 wrote to memory of 3236 568 zip2.exe cmd.exe PID 3236 wrote to memory of 264 3236 cmd.exe mode.com PID 3236 wrote to memory of 264 3236 cmd.exe mode.com PID 3236 wrote to memory of 2964 3236 cmd.exe vssadmin.exe PID 3236 wrote to memory of 2964 3236 cmd.exe vssadmin.exe PID 568 wrote to memory of 1908 568 zip2.exe mshta.exe PID 568 wrote to memory of 1908 568 zip2.exe mshta.exe PID 568 wrote to memory of 2820 568 zip2.exe mshta.exe PID 568 wrote to memory of 2820 568 zip2.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zip2.exe"C:\Users\Admin\AppData\Local\Temp\zip2.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
d495bb0c48da611d7eb4bd6ff7ee232e
SHA1f9a8dab78020909339835f804cf4fa467c905454
SHA25639a60a7ca839e0e6efd803852691167aba684453ab733ee6fcacdf97f7c418d0
SHA512724f074417f4da3b18f560c6b7b6ab27407317180f8e0f964368d427b73b43350bfeb70eb008a8d30125cf9f259289574d33be648e181007f498cdc92dd5b671
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaMD5
d495bb0c48da611d7eb4bd6ff7ee232e
SHA1f9a8dab78020909339835f804cf4fa467c905454
SHA25639a60a7ca839e0e6efd803852691167aba684453ab733ee6fcacdf97f7c418d0
SHA512724f074417f4da3b18f560c6b7b6ab27407317180f8e0f964368d427b73b43350bfeb70eb008a8d30125cf9f259289574d33be648e181007f498cdc92dd5b671
-
memory/264-118-0x0000000000000000-mapping.dmp
-
memory/1908-120-0x0000000000000000-mapping.dmp
-
memory/2820-121-0x0000000000000000-mapping.dmp
-
memory/2964-119-0x0000000000000000-mapping.dmp
-
memory/3236-117-0x0000000000000000-mapping.dmp
-
memory/3800-115-0x0000000000000000-mapping.dmp
-
memory/4040-114-0x0000000000000000-mapping.dmp
-
memory/4064-116-0x0000000000000000-mapping.dmp