Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:37
Static task
static1
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10v2004-20220414-en
General
-
Target
build.exe
-
Size
92KB
-
MD5
411f12fb592afc7f32456cbb18ecaf71
-
SHA1
22573293e8d3a95109322beb4010446402bd783f
-
SHA256
141043cebebde233ff9e5e003079dcdd3eda14b4785b6917dffbe5966fe77a82
-
SHA512
221b1a51823c471c0ef45ad8044c6d219a15422ff17c3771ff7a77dcb9c7a36522ec1bbda5129636b3622217ea8f40b9a3d340887c047b7e9f6da1d02d2a82a0
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
build.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\build.exe build.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
build.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\build.exe = "C:\\Windows\\System32\\build.exe" build.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
build.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\desktop.ini build.exe File opened for modification C:\Program Files\desktop.ini build.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI build.exe -
Drops file in System32 directory 1 IoCs
Processes:
build.exedescription ioc process File created C:\Windows\System32\build.exe build.exe -
Drops file in Program Files directory 64 IoCs
Processes:
build.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\ui-strings.js.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt.id-390233FC.[[email protected]].ROGER build.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-200.jpg build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_In_App_Notification.m4a build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png build.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-125.png build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png build.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-200.png build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\ui-strings.js build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircle.png build.exe File created C:\Program Files\7-Zip\Lang\nb.txt.id-390233FC.[[email protected]].ROGER build.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-30_altform-unplated.png build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\ui-strings.js build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_cs_135x40.svg build.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main.css build.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg.id-390233FC.[[email protected]].ROGER build.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\ui-strings.js build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui build.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\ui-strings.js build.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms build.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\bl.gif.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.id-390233FC.[[email protected]].ROGER build.exe File created C:\Program Files\Java\jre1.8.0_66\bin\npt.dll.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png build.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js build.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\vscroll-thumb.png.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\ui-strings.js.id-390233FC.[[email protected]].ROGER build.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\ui-strings.js.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-black_devicefamily-colorfulunplated.png build.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin build.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css build.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-150.png build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_contrast-white.png build.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms build.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main.css build.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML build.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\Settings.png build.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.id-390233FC.[[email protected]].ROGER build.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected].[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-390233FC.[[email protected]].ROGER build.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms build.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-black_scale-125.png build.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfxswt.jar build.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4568 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
build.exepid process 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe 3016 build.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 5076 vssvc.exe Token: SeRestorePrivilege 5076 vssvc.exe Token: SeAuditPrivilege 5076 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
build.execmd.exedescription pid process target process PID 3016 wrote to memory of 4964 3016 build.exe cmd.exe PID 3016 wrote to memory of 4964 3016 build.exe cmd.exe PID 4964 wrote to memory of 3408 4964 cmd.exe mode.com PID 4964 wrote to memory of 3408 4964 cmd.exe mode.com PID 4964 wrote to memory of 4568 4964 cmd.exe vssadmin.exe PID 4964 wrote to memory of 4568 4964 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3408
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4568
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076