Overview
overview
10Static
static
10samples (2) (2).zip
windows7-x64
1samples (2) (2).zip
windows10-2004-x64
1083e147374...08.exe
windows7-x64
8083e147374...08.exe
windows10-2004-x64
812437a49d2...3d.exe
windows7-x64
712437a49d2...3d.exe
windows10-2004-x64
71945c44901...7e.exe
windows7-x64
91945c44901...7e.exe
windows10-2004-x64
102040fa2a3c...d4.exe
windows7-x64
12040fa2a3c...d4.exe
windows10-2004-x64
12b5109e9a2...d9.exe
windows7-x64
102b5109e9a2...d9.exe
windows10-2004-x64
103538750cfe...5f.exe
windows7-x64
103538750cfe...5f.exe
windows10-2004-x64
105d96952d47...5f.exe
windows7-x64
105d96952d47...5f.exe
windows10-2004-x64
1063fb410fc5...22.exe
windows7-x64
763fb410fc5...22.exe
windows10-2004-x64
767beeb7a19...08.exe
windows7-x64
367beeb7a19...08.exe
windows10-2004-x64
16e5678ebd4...71.exe
windows7-x64
36e5678ebd4...71.exe
windows10-2004-x64
371506a3322...fb.exe
windows7-x64
1071506a3322...fb.exe
windows10-2004-x64
10734b9974ec...6d.exe
windows7-x64
10734b9974ec...6d.exe
windows10-2004-x64
1081a27b3dcf...40.exe
windows7-x64
981a27b3dcf...40.exe
windows10-2004-x64
10a1bd0fa8ad...46.exe
windows7-x64
10a1bd0fa8ad...46.exe
windows10-2004-x64
10a465bc0871...e3.exe
windows7-x64
6a465bc0871...e3.exe
windows10-2004-x64
6Analysis
- max time kernel
152s - max time network
126s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
01/01/2024, 15:12
Behavioral task
behavioral1
Sample
samples (2) (2).zip
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
samples (2) (2).zip
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral9
Sample
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral12
Sample
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral13
Sample
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe
Resource
win7-20231215-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral14
Sample
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral15
Sample
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral17
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Resource
win7-20231215-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral24
Sample
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral25
Sample
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral26
Sample
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral27
Sample
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral28
Sample
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral29
Sample
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral30
Sample
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral31
Sample
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
- Size 597KB
- Sample240101-sladjafeg6
- SHA256 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb
- MD5 ee754ea777505e2fd2870afb325f50e8
- SHA1 be8724e9bd48665ae0c6eedbaf8de23e5987dc45
- SHA512 a6b4acf8c94f1284458a950582ef18adfeac1496e26f537ea21c22f3574b3cffa48e547ea1b9804c45633e12b53c3f1ac1e2d536e150c84ddcbfc9223f525d85
- SSDEEP 12288:td5UKfiOLkxMAgyJ/4zBSqGuKCYminksnkyr2OMnVVs4OgcwdPsc:X5LAHPDuKC8n/dCD9Zsc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Ransom Note
- All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message F3A6D0AA In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails
Signatures
- Detect ZGRat V2 1 IoCs
resource yara_rule behavioral23/memory/2856-4-0x0000000004720000-0x0000000004764000-memory.dmp family_zgrat_v2 - Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta msiexec.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini msiexec.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-F3A6D0AA.[[email protected]].gdb msiexec.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe = "C:\\Windows\\System32\\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe" msiexec.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Links\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Searches\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Desktop\desktop.ini msiexec.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini msiexec.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Music\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Pictures\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini msiexec.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini msiexec.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini msiexec.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini msiexec.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini msiexec.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini msiexec.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini msiexec.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Documents\desktop.ini msiexec.exe File opened for modification C:\Program Files (x86)\desktop.ini msiexec.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini msiexec.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini msiexec.exe File opened for modification C:\Program Files\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ONB28SUK\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Videos\desktop.ini msiexec.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini msiexec.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini msiexec.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini msiexec.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini msiexec.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2C0UXHXX\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZZBGI5OF\desktop.ini msiexec.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini msiexec.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Libraries\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E5Z24JFU\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Videos\desktop.ini msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D2NLQ5QT\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini msiexec.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini msiexec.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2OAODBY\desktop.ini msiexec.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe msiexec.exe File created C:\Windows\System32\Info.hta msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml msiexec.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNoteUI.dll msiexec.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll msiexec.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313965.JPG msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files\Java\jre7\lib\zi\America\Godthab.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0252349.WMF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293828.WMF msiexec.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTEAR.DPV.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\settings.css msiexec.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART2.BDR.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png msiexec.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png msiexec.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\THMBNAIL.PNG.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar msiexec.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50F.GIF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_OFF.GIF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF msiexec.exe File opened for modification C:\Program Files\7-Zip\7z.exe msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF msiexec.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00433_.WMF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12 msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00531L.GIF msiexec.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01785_.WMF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.ITS.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageScript.js msiexec.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui msiexec.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN102.XML msiexec.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBOB6.CHM.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar msiexec.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00957_.WMF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File created C:\Program Files (x86)\Microsoft Office\Office14\msproof7.dll.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195384.WMF.id-F3A6D0AA.[[email protected]].gdb msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe msiexec.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api.id-F3A6D0AA.[[email protected]].gdb msiexec.exe - Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3808 vssadmin.exe 2096 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main mshta.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe 2652 msiexec.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe Token: SeBackupPrivilege 1556 vssvc.exe Token: SeRestorePrivilege 1556 vssvc.exe Token: SeAuditPrivilege 1556 vssvc.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2856 wrote to memory of 2652 2856 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 30 PID 2652 wrote to memory of 1256 2652 msiexec.exe 31 PID 2652 wrote to memory of 1256 2652 msiexec.exe 31 PID 2652 wrote to memory of 1256 2652 msiexec.exe 31 PID 2652 wrote to memory of 1256 2652 msiexec.exe 31 PID 1256 wrote to memory of 2940 1256 cmd.exe 33 PID 1256 wrote to memory of 2940 1256 cmd.exe 33 PID 1256 wrote to memory of 2940 1256 cmd.exe 33 PID 1256 wrote to memory of 2096 1256 cmd.exe 34 PID 1256 wrote to memory of 2096 1256 cmd.exe 34 PID 1256 wrote to memory of 2096 1256 cmd.exe 34 PID 2652 wrote to memory of 3888 2652 msiexec.exe 38 PID 2652 wrote to memory of 3888 2652 msiexec.exe 38 PID 2652 wrote to memory of 3888 2652 msiexec.exe 38 PID 2652 wrote to memory of 3888 2652 msiexec.exe 38 PID 3888 wrote to memory of 3992 3888 cmd.exe 40 PID 3888 wrote to memory of 3992 3888 cmd.exe 40 PID 3888 wrote to memory of 3992 3888 cmd.exe 40 PID 3888 wrote to memory of 3808 3888 cmd.exe 41 PID 3888 wrote to memory of 3808 3888 cmd.exe 41 PID 3888 wrote to memory of 3808 3888 cmd.exe 41 PID 2652 wrote to memory of 3764 2652 msiexec.exe 42 PID 2652 wrote to memory of 3764 2652 msiexec.exe 42 PID 2652 wrote to memory of 3764 2652 msiexec.exe 42 PID 2652 wrote to memory of 3764 2652 msiexec.exe 42 PID 2652 wrote to memory of 3032 2652 msiexec.exe 43 PID 2652 wrote to memory of 3032 2652 msiexec.exe 43 PID 2652 wrote to memory of 3032 2652 msiexec.exe 43 PID 2652 wrote to memory of 3032 2652 msiexec.exe 43 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe"C:\Users\Admin\AppData\Local\Temp\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\system32\mode.commode con cp select=12514⤵PID:2940
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2096
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\system32\mode.commode con cp select=12514⤵PID:3992
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:3808
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
PID:3764
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Modifies Internet Explorer settings
PID:3032
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
OWOW64WW.cab.id-F3A6D0AA.[[email protected]].gdb
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-F3A6D0AA.[[email protected]].gdb
- Size 15.9MB
- SHA256 f8e6f2623a7b42a60f87c8d72a9981f9e39f0f129a9349c6dbcc8f8d9d610941
- MD5 bbf29f73e548db71fa861fa8c1dea881
- SHA1 588d477c909ec8befe4844587da6928ffda22c11
- SHA512 ff9bee53244502b5560ce2de7da0036d6dfcbd64e1bde6073725a259814ae614067c47c9a553ef5768f0261b486832b32515a3551f2c44e7b99ae17566e4b829
- SSDEEP 393216:srjONkLx7xluhiPMkkLfj1ME69Uwg6oYx7ErunJ:srnqahwj1z3wRoYJEr+J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
- Size 13KB
- SHA256 33a62caba2eec5f3966c5b3f01d8b6cf68553c70cceb435eda04d2ae16e9bee2
- MD5 63134c76187b813b09c2db99787b41e3
- SHA1 fd8c69ea82d80f8648668a784bac71eea771eab4
- SHA512 df450f97d65ffb9f75e95a25a80e505e5cfe506753d7489da5e38c736ffa1e10a304101a971a50ec4d375fc1951652c50e230714a027e9ab5df547f1b6898a8d
- SSDEEP 192:sgtyQ092dEwH4sKmVNV8swsqqVV3Kfxhtc+3ROlMrtSZVfVHPJ14ErdgNYA:tE2dE0pKQ1qMatslMrMZVNzd7A
- MD5 SHA1 SHA512 SSDEEP