Analysis
-
max time kernel
149s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 17:58
Static task
static1
Behavioral task
behavioral1
Sample
scandy.exe
Resource
win10v2004-20240412-en
General
-
Target
scandy.exe
-
Size
88KB
-
MD5
56299609780e2286ccc2cf5857d531e8
-
SHA1
ef7baf17905784df491641906645f00f73eff1d1
-
SHA256
ab5be9e6911b43f0974e01dabec772b968274d9b5ea39ba2ad7cd294056e5d09
-
SHA512
a44053d0c810448adddcd17e51682e43d51710de948644c82a141a1a8104cacedd44a274f13ea79de89f5cdfbb0e436791565baad1552d9853a5a94b446398cb
-
SSDEEP
1536:7vie0XQsxILOW3Sm9S4AndhgXCpC1VYEzcM5BD11e0z:OeBsxInSNnhgX4CzwM
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
xmen_xmen@aol.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (518) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
scandy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation scandy.exe -
Drops startup file 5 IoCs
Processes:
scandy.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta scandy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandy.exe scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini scandy.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.[xmen_xmen@aol.com].wallet scandy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
scandy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scandy.exe = "C:\\Windows\\System32\\scandy.exe" scandy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" scandy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" scandy.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
scandy.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini scandy.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini scandy.exe File opened for modification C:\Users\Public\Documents\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini scandy.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2288054676-1871194608-3559553667-1000\desktop.ini scandy.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2288054676-1871194608-3559553667-1000\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Links\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini scandy.exe File opened for modification C:\Users\Public\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini scandy.exe File opened for modification C:\Users\Public\Desktop\desktop.ini scandy.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Music\desktop.ini scandy.exe File opened for modification C:\Users\Public\Pictures\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini scandy.exe File opened for modification C:\Program Files\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Searches\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini scandy.exe File opened for modification C:\Users\Public\Libraries\desktop.ini scandy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini scandy.exe File opened for modification C:\Users\Public\Downloads\desktop.ini scandy.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini scandy.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini scandy.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini scandy.exe File opened for modification C:\Program Files (x86)\desktop.ini scandy.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini scandy.exe -
Drops file in System32 directory 2 IoCs
Processes:
scandy.exedescription ioc process File created C:\Windows\System32\Info.hta scandy.exe File created C:\Windows\System32\scandy.exe scandy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
scandy.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_en-GB.json scandy.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\PREVIEW.GIF.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\9.jpg scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\ui-strings.js.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\SATIN.ELM.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll scandy.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\japanese_over.png.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\ui-strings.js.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80.png scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Json\Person-Content.json scandy.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\Interceptor.tlb.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui scandy.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png scandy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-150.png scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\A12_Roundrect_White@1x.png.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fr.pak.DATA.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\7-Zip\7z.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\A12_FilledDot_White@1x.png.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Confirmation2x.png scandy.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.ELM.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Info.plist scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll scandy.exe File created C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\instrument.dll scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr\ui-strings.js scandy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\ui-strings.js.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\BRANDING.DLL.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Cryptomining.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll scandy.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.[xmen_xmen@aol.com].wallet scandy.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lt.pak.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll scandy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-100.png scandy.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.[xmen_xmen@aol.com].wallet scandy.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe scandy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.ExcelServices.Resources.dll scandy.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll scandy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 9976 vssadmin.exe 2044 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
scandy.exepid process 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe 3872 scandy.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4568 vssvc.exe Token: SeRestorePrivilege 4568 vssvc.exe Token: SeAuditPrivilege 4568 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
scandy.execmd.execmd.exedescription pid process target process PID 3872 wrote to memory of 4696 3872 scandy.exe cmd.exe PID 3872 wrote to memory of 4696 3872 scandy.exe cmd.exe PID 4696 wrote to memory of 652 4696 cmd.exe mode.com PID 4696 wrote to memory of 652 4696 cmd.exe mode.com PID 4696 wrote to memory of 2044 4696 cmd.exe vssadmin.exe PID 4696 wrote to memory of 2044 4696 cmd.exe vssadmin.exe PID 3872 wrote to memory of 8460 3872 scandy.exe cmd.exe PID 3872 wrote to memory of 8460 3872 scandy.exe cmd.exe PID 8460 wrote to memory of 8984 8460 cmd.exe mode.com PID 8460 wrote to memory of 8984 8460 cmd.exe mode.com PID 8460 wrote to memory of 9976 8460 cmd.exe vssadmin.exe PID 8460 wrote to memory of 9976 8460 cmd.exe vssadmin.exe PID 3872 wrote to memory of 9908 3872 scandy.exe mshta.exe PID 3872 wrote to memory of 9908 3872 scandy.exe mshta.exe PID 3872 wrote to memory of 1296 3872 scandy.exe mshta.exe PID 3872 wrote to memory of 1296 3872 scandy.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\scandy.exe"C:\Users\Admin\AppData\Local\Temp\scandy.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.[xmen_xmen@aol.com].walletFilesize
2.7MB
MD56a166bf9d61afa0a068f86e8eba7e8ed
SHA12420dc6c7f7172d9b874a3f6b53f6629204792cc
SHA256edcf9075d62d30dbf3c598ff189996de44b906aca90cbeec5d881742e6422b96
SHA512330eed7613002a43c56c9fcbcfcd671442e52fc2483e8ee905079fe0fb39f4a41699b104e6316127e10c846116f760173aaeb9ba0e4bc012541fdd9c81dd2ed1
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD52df5a461498e11a117a2513f22d203b6
SHA196eecf1b74ef2650be07e062eb7b2597d9c39bc2
SHA2565bcef0258fa0c6a1084ad9824af8aac4ea2a55b8b3597bcd84ba31bfd0ddf551
SHA512e6d8dabb38b666fb99b6409d35d7a6eab25d1802d74a8260cc1d505647d59b98f296d4b869099f96b806883cc611a12e2a9afbff65726dd7f1643d26cc1d0862