Analysis
-
max time kernel
152s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-04-2023 21:24
Static task
static1
Behavioral task
behavioral1
Sample
scandy.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
scandy.exe
Resource
win10v2004-20230220-en
General
-
Target
scandy.exe
-
Size
88KB
-
MD5
56299609780e2286ccc2cf5857d531e8
-
SHA1
ef7baf17905784df491641906645f00f73eff1d1
-
SHA256
ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09
-
SHA512
a44053d0c810448adddcd17e51682e43d51710de948644c82a141a1a8104cacedd44a274f13ea79de89f5cdfbb0e436791565baad1552d9853a5a94b446398cb
-
SSDEEP
1536:7vie0XQsxILOW3Sm9S4AndhgXCpC1VYEzcM5BD11e0z:OeBsxInSNnhgX4CzwM
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
xmen_xmen@aol.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
scandy.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\BlockImport.tiff scandy.exe File opened for modification C:\Users\Admin\Pictures\SkipDisable.tiff scandy.exe -
Drops startup file 5 IoCs
Processes:
scandy.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta scandy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandy.exe scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini scandy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
scandy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scandy.exe = "C:\\Windows\\System32\\scandy.exe" scandy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" scandy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" scandy.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
scandy.exedescription ioc process File opened for modification C:\Users\Public\Videos\desktop.ini scandy.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini scandy.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini scandy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini scandy.exe File opened for modification C:\Users\Public\Documents\desktop.ini scandy.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\WAOMFATN\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini scandy.exe File opened for modification C:\Program Files\desktop.ini scandy.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5TKRPYBV\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini scandy.exe File opened for modification C:\Users\Public\Downloads\desktop.ini scandy.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\DRI6H3TS\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Music\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Searches\desktop.ini scandy.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3499517378-2376672570-1134980332-1000\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\0TVDPZFS\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini scandy.exe File opened for modification C:\Users\Public\desktop.ini scandy.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini scandy.exe File opened for modification C:\Users\Public\Libraries\desktop.ini scandy.exe File opened for modification C:\Users\Public\Pictures\desktop.ini scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8WCRMDC\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini scandy.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini scandy.exe File opened for modification C:\Program Files (x86)\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini scandy.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Links\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini scandy.exe -
Drops file in System32 directory 2 IoCs
Processes:
scandy.exedescription ioc process File created C:\Windows\System32\scandy.exe scandy.exe File created C:\Windows\System32\Info.hta scandy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
scandy.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png scandy.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Iqaluit scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\THMBNAIL.PNG.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01151_.WMF.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01041_.WMF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01394_.WMF scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00132_.WMF scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGATNGET.DPV.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png scandy.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml scandy.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Apex.eftx.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html scandy.exe File created C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02280_.WMF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Mozilla Firefox\mozwer.dll scandy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\PortalConnect.dll scandy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\COUPON.POC.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz scandy.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\picturePuzzle.js scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BREAK.JPG scandy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL108.XML.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AWARDHM.POC scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.DPV scandy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\PREVIEW.GIF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0324694.WMF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740U.BMP.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME50.CSS.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORYVERT.XML scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Students.accdt scandy.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00191_.WMF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\arrow.png.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb scandy.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185834.WMF.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Java\jre7\lib\zi\America\Belem.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PS2SWOOS.POC.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mazatlan scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00068_.WMF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts2.css scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.DPV scandy.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR21F.GIF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak scandy.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\background.gif.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT.DPV scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_F_COL.HXK.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar scandy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2780 vssadmin.exe 984 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
scandy.exepid process 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe 936 scandy.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1720 vssvc.exe Token: SeRestorePrivilege 1720 vssvc.exe Token: SeAuditPrivilege 1720 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
scandy.execmd.execmd.exedescription pid process target process PID 936 wrote to memory of 1500 936 scandy.exe cmd.exe PID 936 wrote to memory of 1500 936 scandy.exe cmd.exe PID 936 wrote to memory of 1500 936 scandy.exe cmd.exe PID 936 wrote to memory of 1500 936 scandy.exe cmd.exe PID 1500 wrote to memory of 1872 1500 cmd.exe mode.com PID 1500 wrote to memory of 1872 1500 cmd.exe mode.com PID 1500 wrote to memory of 1872 1500 cmd.exe mode.com PID 1500 wrote to memory of 984 1500 cmd.exe vssadmin.exe PID 1500 wrote to memory of 984 1500 cmd.exe vssadmin.exe PID 1500 wrote to memory of 984 1500 cmd.exe vssadmin.exe PID 936 wrote to memory of 4028 936 scandy.exe cmd.exe PID 936 wrote to memory of 4028 936 scandy.exe cmd.exe PID 936 wrote to memory of 4028 936 scandy.exe cmd.exe PID 936 wrote to memory of 4028 936 scandy.exe cmd.exe PID 4028 wrote to memory of 3768 4028 cmd.exe mode.com PID 4028 wrote to memory of 3768 4028 cmd.exe mode.com PID 4028 wrote to memory of 3768 4028 cmd.exe mode.com PID 4028 wrote to memory of 2780 4028 cmd.exe vssadmin.exe PID 4028 wrote to memory of 2780 4028 cmd.exe vssadmin.exe PID 4028 wrote to memory of 2780 4028 cmd.exe vssadmin.exe PID 936 wrote to memory of 2376 936 scandy.exe mshta.exe PID 936 wrote to memory of 2376 936 scandy.exe mshta.exe PID 936 wrote to memory of 2376 936 scandy.exe mshta.exe PID 936 wrote to memory of 2376 936 scandy.exe mshta.exe PID 936 wrote to memory of 3304 936 scandy.exe mshta.exe PID 936 wrote to memory of 3304 936 scandy.exe mshta.exe PID 936 wrote to memory of 3304 936 scandy.exe mshta.exe PID 936 wrote to memory of 3304 936 scandy.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\scandy.exe"C:\Users\Admin\AppData\Local\Temp\scandy.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.[xmen_xmen@aol.com].walletFilesize
6.3MB
MD58f8aea199742652bab3bfb940cd7871a
SHA1a01ded170eb31b35999a285d77cacfc97e9467d5
SHA256cd3591fcedb29aafa3af6b3efeb189039ced4fe70661d776880bc503d94adb0b
SHA512135522f1f1b5782c0b40cbd9829c17255320f05f3911658724399cbd18a870be797173ba8e328a42bdb3d8af25b018176489f30a716561758575bd9463b29ec6
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD52df5a461498e11a117a2513f22d203b6
SHA196eecf1b74ef2650be07e062eb7b2597d9c39bc2
SHA2565bcef0258fa0c6a1084ad9824af8aac4ea2a55b8b3597bcd84ba31bfd0ddf551
SHA512e6d8dabb38b666fb99b6409d35d7a6eab25d1802d74a8260cc1d505647d59b98f296d4b869099f96b806883cc611a12e2a9afbff65726dd7f1643d26cc1d0862
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD52df5a461498e11a117a2513f22d203b6
SHA196eecf1b74ef2650be07e062eb7b2597d9c39bc2
SHA2565bcef0258fa0c6a1084ad9824af8aac4ea2a55b8b3597bcd84ba31bfd0ddf551
SHA512e6d8dabb38b666fb99b6409d35d7a6eab25d1802d74a8260cc1d505647d59b98f296d4b869099f96b806883cc611a12e2a9afbff65726dd7f1643d26cc1d0862
-
memory/2376-20148-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB