dharma | 19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b

General

Target

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
Size

218KB
MD5

922c5c0b02c8d6b2a13fa81ae06b8fe7
SHA1

bc7ce36da4ddbe1e9a46aca42da480391d618890
SHA256

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b
SHA512

5b515a1233df312e2229c3dce7b8778983ddf8fd12fd892c8afe101acc69958e58f9a1ce4327be62efc20add05395050508fb3af1c040c8bc396d093a8e335d0
SSDEEP

3072:7ply24btUwSkKLYZuC6ghd/ikDS0C8HlN/Rjxam1f9KH5Q6wjqJdyAC6NRXDordb:7pNmZL6yakG0VuC6NEfvSg

Score

10^/10

dharma persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

Processes:

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe = "C:\\Windows\\System32\\19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe"	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\desktop.ini	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\desktop.ini	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

Drops file in System32 directory 1 IoCs

Processes:

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

description	ioc	process
File created	C:\Windows\System32\19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

description	pid	process	target process
PID 3356 set thread context of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

Drops file in Program Files directory 64 IoCs

Processes:

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\desktop.ini.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\7-Zip\7-zip.chm.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoCanary.png	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\AddGroup.m4v.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\GetOptimize.dotx	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\AddSplit.xls.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoBeta.png.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.id-F813CC90.[neptyn@neptun.company].arena	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1088 vssadmin.exe

pid	process
1088	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

pid	process
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1496 vssvc.exe
Token: SeRestorePrivilege 1496 vssvc.exe
Token: SeAuditPrivilege 1496 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1496	vssvc.exe
Token: SeRestorePrivilege	1496	vssvc.exe
Token: SeAuditPrivilege	1496	vssvc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.execmd.exe

description	pid	process	target process
PID 3356 wrote to memory of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
PID 3356 wrote to memory of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
PID 3356 wrote to memory of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
PID 3356 wrote to memory of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
PID 3356 wrote to memory of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
PID 3356 wrote to memory of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
PID 3356 wrote to memory of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
PID 3356 wrote to memory of 512	3356	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
PID 512 wrote to memory of 5052	512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	cmd.exe
PID 512 wrote to memory of 5052	512	19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe	cmd.exe
PID 5052 wrote to memory of 1352	5052	cmd.exe	mode.com
PID 5052 wrote to memory of 1352	5052	cmd.exe	mode.com
PID 5052 wrote to memory of 1088	5052	cmd.exe	vssadmin.exe
PID 5052 wrote to memory of 1088	5052	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
"C:\Users\Admin\AppData\Local\Temp\19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3356

C:\Users\Admin\AppData\Local\Temp\19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe
"C:\Users\Admin\AppData\Local\Temp\19c918c7fc1714a813824bdf9e95492e53b7df2fe1146e4447170be6ab29a54b.exe"
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\system32\mode.com
mode con cp select=1251
4⤵
PID:1352

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-132-0x0000000000000000-mapping.dmp

Download
memory/512-133-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/512-135-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/512-139-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1088-140-0x0000000000000000-mapping.dmp

Download
memory/1352-138-0x0000000000000000-mapping.dmp

Download
memory/3356-136-0x000000000053B000-0x0000000000555000-memory.dmp

Filesize
104KB

Download
memory/5052-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads