dharma | 8ed183df76d08024f15e051f4f5711535dde6372ff4beafecfff07f82e846800

Analysis

max time kernel
152s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Size

597KB
MD5

ee754ea777505e2fd2870afb325f50e8
SHA1

be8724e9bd48665ae0c6eedbaf8de23e5987dc45
SHA256

71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb
SHA512

a6b4acf8c94f1284458a950582ef18adfeac1496e26f537ea21c22f3574b3cffa48e547ea1b9804c45633e12b53c3f1ac1e2d536e150c84ddcbfc9223f525d85
SSDEEP

12288:td5UKfiOLkxMAgyJ/4zBSqGuKCYminksnkyr2OMnVVs4OgcwdPsc:X5LAHPDuKC8n/dCD9Zsc

Score

10^/10

dharma zgrat persistence ransomware rat

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message F3A6D0AA In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Detect ZGRat V2 1 IoCs

resource	yara_rule
behavioral23/memory/2856-4-0x0000000004720000-0x0000000004764000-memory.dmp	family_zgrat_v2

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	msiexec.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	msiexec.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe = "C:\\Windows\\System32\\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe"	msiexec.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	msiexec.exe
File opened for modification	C:\Program Files\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ONB28SUK\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2C0UXHXX\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZZBGI5OF\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	msiexec.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E5Z24JFU\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D2NLQ5QT\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2OAODBY\desktop.ini	msiexec.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	msiexec.exe
File created	C:\Windows\System32\Info.hta	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNoteUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll	msiexec.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313965.JPG	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Godthab.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0252349.WMF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293828.WMF	msiexec.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTEAR.DPV.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\settings.css	msiexec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART2.BDR.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png	msiexec.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png	msiexec.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\THMBNAIL.PNG.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50F.GIF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_OFF.GIF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04196_.WMF	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF	msiexec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00433_.WMF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00531L.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01785_.WMF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.ITS.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageScript.js	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui	msiexec.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN102.XML	msiexec.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBOB6.CHM.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00957_.WMF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\msproof7.dll.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195384.WMF.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api.id-F3A6D0AA.[[email protected]].gdb	msiexec.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3808	vssadmin.exe
2096	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe
2652	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Token: SeBackupPrivilege	1556	vssvc.exe
Token: SeRestorePrivilege	1556	vssvc.exe
Token: SeAuditPrivilege	1556	vssvc.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2856 wrote to memory of 2652	2856	71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe	30
PID 2652 wrote to memory of 1256	2652	msiexec.exe	31
PID 2652 wrote to memory of 1256	2652	msiexec.exe	31
PID 2652 wrote to memory of 1256	2652	msiexec.exe	31
PID 2652 wrote to memory of 1256	2652	msiexec.exe	31
PID 1256 wrote to memory of 2940	1256	cmd.exe	33
PID 1256 wrote to memory of 2940	1256	cmd.exe	33
PID 1256 wrote to memory of 2940	1256	cmd.exe	33
PID 1256 wrote to memory of 2096	1256	cmd.exe	34
PID 1256 wrote to memory of 2096	1256	cmd.exe	34
PID 1256 wrote to memory of 2096	1256	cmd.exe	34
PID 2652 wrote to memory of 3888	2652	msiexec.exe	38
PID 2652 wrote to memory of 3888	2652	msiexec.exe	38
PID 2652 wrote to memory of 3888	2652	msiexec.exe	38
PID 2652 wrote to memory of 3888	2652	msiexec.exe	38
PID 3888 wrote to memory of 3992	3888	cmd.exe	40
PID 3888 wrote to memory of 3992	3888	cmd.exe	40
PID 3888 wrote to memory of 3992	3888	cmd.exe	40
PID 3888 wrote to memory of 3808	3888	cmd.exe	41
PID 3888 wrote to memory of 3808	3888	cmd.exe	41
PID 3888 wrote to memory of 3808	3888	cmd.exe	41
PID 2652 wrote to memory of 3764	2652	msiexec.exe	42
PID 2652 wrote to memory of 3764	2652	msiexec.exe	42
PID 2652 wrote to memory of 3764	2652	msiexec.exe	42
PID 2652 wrote to memory of 3764	2652	msiexec.exe	42
PID 2652 wrote to memory of 3032	2652	msiexec.exe	43
PID 2652 wrote to memory of 3032	2652	msiexec.exe	43
PID 2652 wrote to memory of 3032	2652	msiexec.exe	43
PID 2652 wrote to memory of 3032	2652	msiexec.exe	43

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
"C:\Users\Admin\AppData\Local\Temp\71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:2940
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2096
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:3992
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3808
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    - Modifies Internet Explorer settings
    PID:3764
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    - Modifies Internet Explorer settings
    PID:3032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-F3A6D0AA.[[email protected]].gdb

Filesize
15.9MB

MD5
bbf29f73e548db71fa861fa8c1dea881

SHA1
588d477c909ec8befe4844587da6928ffda22c11

SHA256
f8e6f2623a7b42a60f87c8d72a9981f9e39f0f129a9349c6dbcc8f8d9d610941

SHA512
ff9bee53244502b5560ce2de7da0036d6dfcbd64e1bde6073725a259814ae614067c47c9a553ef5768f0261b486832b32515a3551f2c44e7b99ae17566e4b829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
63134c76187b813b09c2db99787b41e3

SHA1
fd8c69ea82d80f8648668a784bac71eea771eab4

SHA256
33a62caba2eec5f3966c5b3f01d8b6cf68553c70cceb435eda04d2ae16e9bee2

SHA512
df450f97d65ffb9f75e95a25a80e505e5cfe506753d7489da5e38c736ffa1e10a304101a971a50ec4d375fc1951652c50e230714a027e9ab5df547f1b6898a8d

Download Submit
memory/2652-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-13-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2652-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2652-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2856-8-0x00000000049A0000-0x00000000049E0000-memory.dmp

Filesize
256KB

Download
memory/2856-7-0x00000000049A0000-0x00000000049E0000-memory.dmp

Filesize
256KB

Download
memory/2856-1-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2856-6-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2856-4-0x0000000004720000-0x0000000004764000-memory.dmp

Filesize
272KB

Download
memory/2856-3-0x00000000049A0000-0x00000000049E0000-memory.dmp

Filesize
256KB

Download
memory/2856-2-0x00000000049A0000-0x00000000049E0000-memory.dmp

Filesize
256KB

Download
memory/2856-9214-0x0000000074480000-0x0000000074B6E000-memory.dmp

Filesize
6.9MB

Download
memory/2856-0-0x00000000000F0000-0x000000000018C000-memory.dmp

Filesize
624KB

Download