dharma | 79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1

General

Target

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
Size

428KB
MD5

5cd725ccdd4a940bc19c9bcd69768798
SHA1

cb5c0c4ed17bc9dd83c85777ecb2f37ec060c50d
SHA256

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1
SHA512

3ac834a0b1e9d9693e5e598c8132d1e33594415be90ee6ba321144c4128bedbfefd0420926729d5e8469ee616ed986b03f8a1c822704ff9537fe17ce7cfa4605
SSDEEP

6144:U9nXFNky+V6KJZ5IP9zHX00YXoOzlVTnHHZVaAG72I+rpuTPoeSyaY9B:UlXFNky+V6KPOVQ9LzTHZV4axaPogVL

Score

10^/10

dharma persistence ransomware spyware stealer

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

Processes:

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe = "C:\\Windows\\System32\\79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe"	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

Drops desktop.ini file(s) 13 IoCs

Processes:

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

description	ioc	process
File opened for modification	C:\Program Files\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3406023954-474543476-3319432036-1000\desktop.ini	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

Drops file in System32 directory 1 IoCs

Processes:

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

description	ioc	process
File created	C:\Windows\System32\79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

description	pid	process	target process
PID 2008 set thread context of 912	2008	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

Drops file in Program Files directory 64 IoCs

Processes:

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe.sig.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18204_.WMF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadomd.dll	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01761_.WMF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199429.WMF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01563_.WMF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21336_.GIF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14801_.GIF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_OFF.GIF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00685_.WMF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15073_.GIF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Internet Explorer\jsdbgui.dll	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\STOCKS.XML	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\Java\jre7\bin\jsoundds.dll.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr\default.jfc	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21504_.GIF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143753.GIF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\Java\jre7\lib\jvm.hprof.txt.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186348.WMF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151047.WMF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CRANE.WMF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299763.WMF.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\settings.js	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\charsets.jar.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05930_.WMF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.id-1B68134C.[3442516480@qq.com].pdf	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1760 vssadmin.exe

pid	process
1760	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

pid	process
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 756 vssvc.exe
Token: SeRestorePrivilege 756 vssvc.exe
Token: SeAuditPrivilege 756 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	756	vssvc.exe
Token: SeRestorePrivilege	756	vssvc.exe
Token: SeAuditPrivilege	756	vssvc.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.execmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 912	2008	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
PID 2008 wrote to memory of 912	2008	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
PID 2008 wrote to memory of 912	2008	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
PID 2008 wrote to memory of 912	2008	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
PID 2008 wrote to memory of 912	2008	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
PID 912 wrote to memory of 1824	912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	cmd.exe
PID 912 wrote to memory of 1824	912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	cmd.exe
PID 912 wrote to memory of 1824	912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	cmd.exe
PID 912 wrote to memory of 1824	912	79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe	cmd.exe
PID 1824 wrote to memory of 2016	1824	cmd.exe	mode.com
PID 1824 wrote to memory of 2016	1824	cmd.exe	mode.com
PID 1824 wrote to memory of 2016	1824	cmd.exe	mode.com
PID 1824 wrote to memory of 1760	1824	cmd.exe	vssadmin.exe
PID 1824 wrote to memory of 1760	1824	cmd.exe	vssadmin.exe
PID 1824 wrote to memory of 1760	1824	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
"C:\Users\Admin\AppData\Local\Temp\79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
C:\Users\Admin\AppData\Local\Temp\79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\system32\mode.com
mode con cp select=1251
4⤵
PID:2016

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/912-61-0x000000000040A9D0-mapping.dmp

Download
memory/912-62-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1760-66-0x0000000000000000-mapping.dmp

Download
memory/1824-64-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000001F50000-0x0000000001F83000-memory.dmp

Filesize
204KB

Download
memory/2016-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads