Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-09-2022 14:59
Static task
static1
Behavioral task
behavioral1
Sample
winhost.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
winhost.exe
Resource
win10v2004-20220812-en
General
-
Target
winhost.exe
-
Size
92KB
-
MD5
c24f6144e905b717a372c529d969611e
-
SHA1
0a297e9e5c807c06ad10f4f746f4f9e256df6743
-
SHA256
94ef44e3f7be172fb47203eb942e4601f1a96cb4bfd37e055fd6cf39b5db49a6
-
SHA512
f0b883f54808a5e669fdd7a41a3899d302edb8c4e6160ea88ec8cb25783d56c39a815b922b17ed133610f1dc3bc515eba63410d381d0e65e0998e2b752b0874f
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AqVsOF7+9UFEkzgAhRJpOKGkEb1S/:Qw+asqN5aW/hLI1iUFEkJLJcUEb1S/
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
GetDecoding@zimbabwe.su
getdecoding@msgsafe.io
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
winhost.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\PublishCheckpoint.tiff winhost.exe -
Drops startup file 5 IoCs
Processes:
winhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winhost.exe winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini winhost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta winhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
winhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winhost.exe = "C:\\Windows\\System32\\winhost.exe" winhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" winhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" winhost.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
winhost.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini winhost.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini winhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini winhost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8PENRVY0\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTOVLSHV\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini winhost.exe File opened for modification C:\Users\Public\Libraries\desktop.ini winhost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini winhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini winhost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini winhost.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini winhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini winhost.exe File opened for modification C:\Users\Public\Music\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini winhost.exe File opened for modification C:\Users\Admin\Links\desktop.ini winhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini winhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\INLM2B61\desktop.ini winhost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini winhost.exe File opened for modification C:\Users\Public\desktop.ini winhost.exe File opened for modification C:\Program Files\desktop.ini winhost.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini winhost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini winhost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini winhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini winhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6THCX874\desktop.ini winhost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini winhost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini winhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini winhost.exe File opened for modification C:\Users\Public\Downloads\desktop.ini winhost.exe File opened for modification C:\Users\Public\Videos\desktop.ini winhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini winhost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini winhost.exe File opened for modification C:\Users\Public\Documents\desktop.ini winhost.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini winhost.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini winhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini winhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini winhost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini winhost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini winhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini winhost.exe File opened for modification C:\Program Files (x86)\desktop.ini winhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QAI10AFD\desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini winhost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini winhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini winhost.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\desktop.ini winhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini winhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini winhost.exe File opened for modification C:\Users\Admin\Music\desktop.ini winhost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini winhost.exe -
Drops file in System32 directory 2 IoCs
Processes:
winhost.exedescription ioc process File created C:\Windows\System32\winhost.exe winhost.exe File created C:\Windows\System32\Info.hta winhost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
winhost.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR16F.GIF.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\HST.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00452_.WMF winhost.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryNewsletter.dotx.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPORTL.ICO winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOMAIL.CFG.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG winhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cayman winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_OFF.GIF winhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\PublicFunctions.js.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPICCAP.XML winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\TAB_OFF.GIF winhost.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_03.MID.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00242_.WMF winhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Inuvik winhost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XMLSDK5.CHM.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia winhost.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01297_.GIF.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD98SP.POC winhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html winhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGAD.DPV.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo winhost.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLPERF.INI.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\UnformattedNumeric.jpg winhost.exe File created C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_ml.dll.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01603_.WMF.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apex.thmx.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215076.WMF.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Metro.thmx winhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD11.POC.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.id-E1C585CA.[GetDecoding@zimbabwe.su].get winhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 524 vssadmin.exe 1996 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winhost.exepid process 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe 1044 winhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 536 vssvc.exe Token: SeRestorePrivilege 536 vssvc.exe Token: SeAuditPrivilege 536 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
winhost.execmd.execmd.exedescription pid process target process PID 1044 wrote to memory of 1064 1044 winhost.exe cmd.exe PID 1044 wrote to memory of 1064 1044 winhost.exe cmd.exe PID 1044 wrote to memory of 1064 1044 winhost.exe cmd.exe PID 1044 wrote to memory of 1064 1044 winhost.exe cmd.exe PID 1064 wrote to memory of 892 1064 cmd.exe mode.com PID 1064 wrote to memory of 892 1064 cmd.exe mode.com PID 1064 wrote to memory of 892 1064 cmd.exe mode.com PID 1064 wrote to memory of 524 1064 cmd.exe vssadmin.exe PID 1064 wrote to memory of 524 1064 cmd.exe vssadmin.exe PID 1064 wrote to memory of 524 1064 cmd.exe vssadmin.exe PID 1044 wrote to memory of 1988 1044 winhost.exe cmd.exe PID 1044 wrote to memory of 1988 1044 winhost.exe cmd.exe PID 1044 wrote to memory of 1988 1044 winhost.exe cmd.exe PID 1044 wrote to memory of 1988 1044 winhost.exe cmd.exe PID 1988 wrote to memory of 1004 1988 cmd.exe mode.com PID 1988 wrote to memory of 1004 1988 cmd.exe mode.com PID 1988 wrote to memory of 1004 1988 cmd.exe mode.com PID 1988 wrote to memory of 1996 1988 cmd.exe vssadmin.exe PID 1988 wrote to memory of 1996 1988 cmd.exe vssadmin.exe PID 1988 wrote to memory of 1996 1988 cmd.exe vssadmin.exe PID 1044 wrote to memory of 1588 1044 winhost.exe mshta.exe PID 1044 wrote to memory of 1588 1044 winhost.exe mshta.exe PID 1044 wrote to memory of 1588 1044 winhost.exe mshta.exe PID 1044 wrote to memory of 1588 1044 winhost.exe mshta.exe PID 1044 wrote to memory of 2024 1044 winhost.exe mshta.exe PID 1044 wrote to memory of 2024 1044 winhost.exe mshta.exe PID 1044 wrote to memory of 2024 1044 winhost.exe mshta.exe PID 1044 wrote to memory of 2024 1044 winhost.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\winhost.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD59a0615037591ba5302852ae9b05f252a
SHA1f622df52ee04a050ada4d0b5f72078b30abc6b46
SHA256be2c3666054890e199f6616210d365f8981b31f12a103997ea156eb54b487f55
SHA5122469563f4de7e27811ab01a668d523ae564ee1afe2370a63cbfb4fd021e8b776450d1f952c5e9d8ea5e81bd4baca0371b6135b48021b44124ec2a3b4905afada
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD59a0615037591ba5302852ae9b05f252a
SHA1f622df52ee04a050ada4d0b5f72078b30abc6b46
SHA256be2c3666054890e199f6616210d365f8981b31f12a103997ea156eb54b487f55
SHA5122469563f4de7e27811ab01a668d523ae564ee1afe2370a63cbfb4fd021e8b776450d1f952c5e9d8ea5e81bd4baca0371b6135b48021b44124ec2a3b4905afada
-
memory/524-57-0x0000000000000000-mapping.dmp
-
memory/892-56-0x0000000000000000-mapping.dmp
-
memory/1004-59-0x0000000000000000-mapping.dmp
-
memory/1044-54-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB
-
memory/1064-55-0x0000000000000000-mapping.dmp
-
memory/1588-61-0x0000000000000000-mapping.dmp
-
memory/1988-58-0x0000000000000000-mapping.dmp
-
memory/1996-60-0x0000000000000000-mapping.dmp
-
memory/2024-62-0x0000000000000000-mapping.dmp