Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2023 02:39
Static task
static1
Behavioral task
behavioral1
Sample
scandy.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
scandy.exe
Resource
win10v2004-20230220-en
General
-
Target
scandy.exe
-
Size
88KB
-
MD5
56299609780e2286ccc2cf5857d531e8
-
SHA1
ef7baf17905784df491641906645f00f73eff1d1
-
SHA256
ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09
-
SHA512
a44053d0c810448adddcd17e51682e43d51710de948644c82a141a1a8104cacedd44a274f13ea79de89f5cdfbb0e436791565baad1552d9853a5a94b446398cb
-
SSDEEP
1536:7vie0XQsxILOW3Sm9S4AndhgXCpC1VYEzcM5BD11e0z:OeBsxInSNnhgX4CzwM
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
xmen_xmen@aol.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
scandy.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\PushComplete.tiff scandy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
scandy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation scandy.exe -
Drops startup file 5 IoCs
Processes:
scandy.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandy.exe scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini scandy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta scandy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
scandy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scandy.exe = "C:\\Windows\\System32\\scandy.exe" scandy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" scandy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" scandy.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
scandy.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini scandy.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1529757233-3489015626-3409890339-1000\desktop.ini scandy.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini scandy.exe File opened for modification C:\Users\Public\Desktop\desktop.ini scandy.exe File opened for modification C:\Users\Public\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini scandy.exe File opened for modification C:\Program Files (x86)\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini scandy.exe File opened for modification C:\Users\Public\Music\desktop.ini scandy.exe File opened for modification C:\Program Files\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini scandy.exe File opened for modification C:\Users\Public\Libraries\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Videos\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Links\desktop.ini scandy.exe File opened for modification C:\Users\Public\Downloads\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Searches\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Music\desktop.ini scandy.exe File opened for modification C:\Users\Public\Pictures\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini scandy.exe -
Drops file in System32 directory 2 IoCs
Processes:
scandy.exedescription ioc process File created C:\Windows\System32\scandy.exe scandy.exe File created C:\Windows\System32\Info.hta scandy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
scandy.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-300.png scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl scandy.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\PREVIEW.GIF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark@4x.png.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-black_scale-200.png scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.scale-200.png scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\ui-strings.js scandy.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\profile.jfc.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-150_contrast-white.png scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\ui-strings.js.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ko.pak.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MediumTile.scale-125_contrast-white.png scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fr-fr\ui-strings.js.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe scandy.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ml.pak.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\7-Zip\7zG.exe.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPMediaSharing.dll scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\comment.svg.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml scandy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down-pressed.gif.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\selector.js.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-150.png scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\bl.gif.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-hover.svg.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg scandy.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Edge.dat.DATA scandy.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230220184334.pma.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_es_135x40.svg scandy.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.173.45\msedgeupdateres_lo.dll scandy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.ELM.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\MSFT_PackageManagementSource.strings.psd1.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeGreaterThan.Tests.ps1 scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-400.png scandy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.[xmen_xmen@aol.com].wallet scandy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2424 vssadmin.exe 2412 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
scandy.exepid process 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe 1764 scandy.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2612 vssvc.exe Token: SeRestorePrivilege 2612 vssvc.exe Token: SeAuditPrivilege 2612 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
scandy.execmd.execmd.exedescription pid process target process PID 1764 wrote to memory of 912 1764 scandy.exe cmd.exe PID 1764 wrote to memory of 912 1764 scandy.exe cmd.exe PID 912 wrote to memory of 3176 912 cmd.exe mode.com PID 912 wrote to memory of 3176 912 cmd.exe mode.com PID 912 wrote to memory of 2424 912 cmd.exe vssadmin.exe PID 912 wrote to memory of 2424 912 cmd.exe vssadmin.exe PID 1764 wrote to memory of 4652 1764 scandy.exe cmd.exe PID 1764 wrote to memory of 4652 1764 scandy.exe cmd.exe PID 4652 wrote to memory of 4004 4652 cmd.exe mode.com PID 4652 wrote to memory of 4004 4652 cmd.exe mode.com PID 4652 wrote to memory of 2412 4652 cmd.exe vssadmin.exe PID 4652 wrote to memory of 2412 4652 cmd.exe vssadmin.exe PID 1764 wrote to memory of 864 1764 scandy.exe mshta.exe PID 1764 wrote to memory of 864 1764 scandy.exe mshta.exe PID 1764 wrote to memory of 1476 1764 scandy.exe mshta.exe PID 1764 wrote to memory of 1476 1764 scandy.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\scandy.exe"C:\Users\Admin\AppData\Local\Temp\scandy.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.[xmen_xmen@aol.com].walletFilesize
2.9MB
MD521b14c05a9347060e0a83b1877659bb0
SHA1588c01d6503a49d9953f86592ed477aabadcc6ef
SHA256225913331816261f125cac6e37a479d3980c60b046953d0a884532e7a6c2d8b9
SHA512dde37c3717f0ee7c22cef232b4c6e1681cfcc2d980c6c205691a20b71a9f4caee370ae11a29aeadfe304b246430f99d54d62d766b4e42a1875844b61f4998d11
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD52df5a461498e11a117a2513f22d203b6
SHA196eecf1b74ef2650be07e062eb7b2597d9c39bc2
SHA2565bcef0258fa0c6a1084ad9824af8aac4ea2a55b8b3597bcd84ba31bfd0ddf551
SHA512e6d8dabb38b666fb99b6409d35d7a6eab25d1802d74a8260cc1d505647d59b98f296d4b869099f96b806883cc611a12e2a9afbff65726dd7f1643d26cc1d0862
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD52df5a461498e11a117a2513f22d203b6
SHA196eecf1b74ef2650be07e062eb7b2597d9c39bc2
SHA2565bcef0258fa0c6a1084ad9824af8aac4ea2a55b8b3597bcd84ba31bfd0ddf551
SHA512e6d8dabb38b666fb99b6409d35d7a6eab25d1802d74a8260cc1d505647d59b98f296d4b869099f96b806883cc611a12e2a9afbff65726dd7f1643d26cc1d0862