dharma | 0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43

General

Target

payload.exe
Size

92KB
MD5

a0dd1dfbac4b2aaed94b2065a9c9f30c
SHA1

b797000407eb333dc80777dd088204179b62fb5c
SHA256

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43
SHA512

13949bcbd0a6d7efee4e466f9f8818bd4b0643f8bc1116cd302b9b72808dbe018e30aa36d1edd4474ebf590d5d29438247f391988b6b2b5a5188d79a47ae1229
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4AQp27xRgjGri0wEeKirLWP6d7cH:Qw+asqN5aW/hL+pwl2RsivPd

Score

10^/10

dharma persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

payload.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\NewCompare.tiff	payload.exe
File opened for modification	C:\Users\Admin\Pictures\SendFind.tiff	payload.exe

Drops startup file 5 IoCs

Processes:

payload.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe	payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-4E4AB646.[[email protected]].ccd	payload.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

payload.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\payload.exe = "C:\\Windows\\System32\\payload.exe"	payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	payload.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

payload.exe

description	ioc	process
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	payload.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XS6M157B\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	payload.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	payload.exe
File opened for modification	C:\Users\Public\desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HC7ZN6SY\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	payload.exe
File opened for modification	C:\Program Files\desktop.ini	payload.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1XDFWCRE\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	payload.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	payload.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3375IQM\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	payload.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3430344531-3702557399-3004411149-1000\desktop.ini	payload.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	payload.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	payload.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	payload.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	payload.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AAHHC1TR\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	payload.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	payload.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	payload.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	payload.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	payload.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	payload.exe

Drops file in System32 directory 2 IoCs

Processes:

payload.exe

description ioc process

File created C:\Windows\System32\payload.exe payload.exe
File created C:\Windows\System32\Info.hta payload.exe

description	ioc	process
File created	C:\Windows\System32\payload.exe	payload.exe
File created	C:\Windows\System32\Info.hta	payload.exe

Drops file in Program Files directory 64 IoCs

Processes:

payload.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\be.txt.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_on.gif.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK	payload.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll	payload.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153508.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02125_.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02752U.BMP.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN109.XML.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01680_.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00938_.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299611.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR36F.GIF	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer	payload.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148798.JPG.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF	payload.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153265.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2F.GIF	payload.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png	payload.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0157995.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182888.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293238.WMF	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PPINTL.REST.IDX_DLL	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar	payload.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg	payload.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\REPTWIZ.POC.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\de-DE\msoeres.dll.mui	payload.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\PREVIEW.GIF.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg.id-4E4AB646.[[email protected]].ccd	payload.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL108.XML	payload.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Martinique.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239943.WMF	payload.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0090386.WMF.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FORM.ICO	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLCALL32.DLL	payload.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.id-4E4AB646.[[email protected]].ccd	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105306.WMF	payload.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Elemental.xml.id-4E4AB646.[[email protected]].ccd	payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1908 vssadmin.exe
2736 vssadmin.exe

pid	process
1908	vssadmin.exe
2736	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

payload.exe

pid	process
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe
1728	payload.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 936 vssvc.exe
Token: SeRestorePrivilege 936 vssvc.exe
Token: SeAuditPrivilege 936 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	936	vssvc.exe
Token: SeRestorePrivilege	936	vssvc.exe
Token: SeAuditPrivilege	936	vssvc.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

payload.execmd.execmd.exe

description	pid	process	target process
PID 1728 wrote to memory of 1996	1728	payload.exe	cmd.exe
PID 1728 wrote to memory of 1996	1728	payload.exe	cmd.exe
PID 1728 wrote to memory of 1996	1728	payload.exe	cmd.exe
PID 1728 wrote to memory of 1996	1728	payload.exe	cmd.exe
PID 1996 wrote to memory of 1440	1996	cmd.exe	mode.com
PID 1996 wrote to memory of 1440	1996	cmd.exe	mode.com
PID 1996 wrote to memory of 1440	1996	cmd.exe	mode.com
PID 1996 wrote to memory of 1908	1996	cmd.exe	vssadmin.exe
PID 1996 wrote to memory of 1908	1996	cmd.exe	vssadmin.exe
PID 1996 wrote to memory of 1908	1996	cmd.exe	vssadmin.exe
PID 1728 wrote to memory of 2892	1728	payload.exe	cmd.exe
PID 1728 wrote to memory of 2892	1728	payload.exe	cmd.exe
PID 1728 wrote to memory of 2892	1728	payload.exe	cmd.exe
PID 1728 wrote to memory of 2892	1728	payload.exe	cmd.exe
PID 2892 wrote to memory of 3052	2892	cmd.exe	mode.com
PID 2892 wrote to memory of 3052	2892	cmd.exe	mode.com
PID 2892 wrote to memory of 3052	2892	cmd.exe	mode.com
PID 2892 wrote to memory of 2736	2892	cmd.exe	vssadmin.exe
PID 2892 wrote to memory of 2736	2892	cmd.exe	vssadmin.exe
PID 2892 wrote to memory of 2736	2892	cmd.exe	vssadmin.exe
PID 1728 wrote to memory of 2100	1728	payload.exe	mshta.exe
PID 1728 wrote to memory of 2100	1728	payload.exe	mshta.exe
PID 1728 wrote to memory of 2100	1728	payload.exe	mshta.exe
PID 1728 wrote to memory of 2100	1728	payload.exe	mshta.exe
PID 1728 wrote to memory of 2520	1728	payload.exe	mshta.exe
PID 1728 wrote to memory of 2520	1728	payload.exe	mshta.exe
PID 1728 wrote to memory of 2520	1728	payload.exe	mshta.exe
PID 1728 wrote to memory of 2520	1728	payload.exe	mshta.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\payload.exe
"C:\Users\Admin\AppData\Local\Temp\payload.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:1440
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1908
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:3052
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2736
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:2100
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:2520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-4E4AB646.[[email protected]].ccd

Filesize
23.5MB

MD5
ba329ff47342a9f95b331621526359a3

SHA1
e5cbefaf1e7a3e51433944a2eaf617f86f3503cb

SHA256
b0937683df0fe6061b0d49f685be91e301c42a6a1550ed0c43cd02abc643fc29

SHA512
f2bec01bc71a2c2a0e43517178096d14e89f320d22d1e5b6d32e2c31e955f0ac24eb5fe00623203685bb00cc177df3fbccb5bdcf8a1cc971f030054b8b7d87c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
7KB

MD5
376b30ec82b999a1a39e8c598c780526

SHA1
044323a0ed1f5376cd7bf7034ddbbcf09809f63c

SHA256
1a0ec764734febcb79c5d676a810f952ddde78d91521920cbb5d25109bd8c97d

SHA512
c0a98c359765f44693fb979b85b8a47b72bd11ba72f2436c55647c705bfc1750783ca5b32391ec3aae87b4cb2cbec1407eaa2dfcc3e829045c99f13de20589fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
7KB

MD5
376b30ec82b999a1a39e8c598c780526

SHA1
044323a0ed1f5376cd7bf7034ddbbcf09809f63c

SHA256
1a0ec764734febcb79c5d676a810f952ddde78d91521920cbb5d25109bd8c97d

SHA512
c0a98c359765f44693fb979b85b8a47b72bd11ba72f2436c55647c705bfc1750783ca5b32391ec3aae87b4cb2cbec1407eaa2dfcc3e829045c99f13de20589fe

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads