dharma | 8ff8af7b31fe7ed58b2afc1b556c635c2ccdf20bce7ca371897dea490a8b5027

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
Size

92KB
MD5

a0dd1dfbac4b2aaed94b2065a9c9f30c
SHA1

b797000407eb333dc80777dd088204179b62fb5c
SHA256

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43
SHA512

13949bcbd0a6d7efee4e466f9f8818bd4b0643f8bc1116cd302b9b72808dbe018e30aa36d1edd4474ebf590d5d29438247f391988b6b2b5a5188d79a47ae1229
SSDEEP

1536:mBwl+KXpsqN5vlwWYyhY9S4AQp27xRgjGri0wEeKirLWP6d7cH:Qw+asqN5aW/hL+pwl2RsivPd

Score

10^/10

dharma defense_evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 5 IoCs

Processes:

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

Loads dropped DLL 7 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid process

4672 MsiExec.exe
4672 MsiExec.exe
4672 MsiExec.exe
4672 MsiExec.exe
4672 MsiExec.exe
4672 MsiExec.exe
3704 MsiExec.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4672	MsiExec.exe
4672	MsiExec.exe
4672	MsiExec.exe
4672	MsiExec.exe
4672	MsiExec.exe
4672	MsiExec.exe
3704	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe = "C:\\Windows\\System32\\0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe"	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0JY8H21Z\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\N7ZQRMOO\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OW9ZQM06\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZO1X14N3\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V8SGIH7I\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M720ATCO\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MN6S8FGK\desktop.ini	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

description	ioc	process
File created	C:\Windows\System32\0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Windows\System32\Info.hta	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

Drops file in Program Files directory 64 IoCs

Processes:

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PRODIGY.NET.XML.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SEQCHK10.DLL.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\MLA.XSL.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00152_.WMF	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00289_.WMF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Equity.thmx.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageScript.js	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Essential.eftx.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_decreaseindent.gif.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_hyperlink.gif.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00807_.WMF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02287_.WMF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187849.WMF	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_ON.GIF	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBBTN.XML.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187819.WMF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\Revert.wmz	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Metro.thmx.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00221_.WMF	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Blog.dotx.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174315.WMF	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\BUZZ.WAV.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239057.WMF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18202_.WMF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21481_.GIF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\THMBNAIL.PNG	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02748G.GIF	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2F.GIF.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.KR.XML	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT.XML.id-1DC4A173.[[email protected]].ccd	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI14BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f771087.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI148E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1420.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f771084.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI118F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI181A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f771087.ipi	msiexec.exe
File created	C:\Windows\Installer\f771084.mst	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

2636 vssadmin.exe
4272 vssadmin.exe

pid	process
2636	vssadmin.exe
4272	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exemsiexec.exe

pid	process
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
4860	msiexec.exe
4860	msiexec.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

vssvc.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	1452	vssvc.exe
Token: SeRestorePrivilege	1452	vssvc.exe
Token: SeAuditPrivilege	1452	vssvc.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeSecurityPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe
Token: SeRestorePrivilege	4860	msiexec.exe
Token: SeTakeOwnershipPrivilege	4860	msiexec.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.execmd.execmd.exemsiexec.exe

description	pid	process	target process
PID 2580 wrote to memory of 1376	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	cmd.exe
PID 2580 wrote to memory of 1376	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	cmd.exe
PID 2580 wrote to memory of 1376	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	cmd.exe
PID 2580 wrote to memory of 1376	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	cmd.exe
PID 1376 wrote to memory of 2836	1376	cmd.exe	mode.com
PID 1376 wrote to memory of 2836	1376	cmd.exe	mode.com
PID 1376 wrote to memory of 2836	1376	cmd.exe	mode.com
PID 1376 wrote to memory of 2636	1376	cmd.exe	vssadmin.exe
PID 1376 wrote to memory of 2636	1376	cmd.exe	vssadmin.exe
PID 1376 wrote to memory of 2636	1376	cmd.exe	vssadmin.exe
PID 2580 wrote to memory of 4740	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	cmd.exe
PID 2580 wrote to memory of 4740	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	cmd.exe
PID 2580 wrote to memory of 4740	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	cmd.exe
PID 2580 wrote to memory of 4740	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	cmd.exe
PID 4740 wrote to memory of 4736	4740	cmd.exe	mode.com
PID 4740 wrote to memory of 4736	4740	cmd.exe	mode.com
PID 4740 wrote to memory of 4736	4740	cmd.exe	mode.com
PID 4740 wrote to memory of 4272	4740	cmd.exe	vssadmin.exe
PID 4740 wrote to memory of 4272	4740	cmd.exe	vssadmin.exe
PID 4740 wrote to memory of 4272	4740	cmd.exe	vssadmin.exe
PID 4860 wrote to memory of 4672	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 4672	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 4672	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 4672	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 4672	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 4672	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 4672	4860	msiexec.exe	MsiExec.exe
PID 2580 wrote to memory of 5088	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	mshta.exe
PID 2580 wrote to memory of 5088	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	mshta.exe
PID 2580 wrote to memory of 5088	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	mshta.exe
PID 2580 wrote to memory of 5088	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	mshta.exe
PID 2580 wrote to memory of 4560	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	mshta.exe
PID 2580 wrote to memory of 4560	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	mshta.exe
PID 2580 wrote to memory of 4560	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	mshta.exe
PID 2580 wrote to memory of 4560	2580	0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe	mshta.exe
PID 4860 wrote to memory of 3704	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 3704	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 3704	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 3704	4860	msiexec.exe	MsiExec.exe
PID 4860 wrote to memory of 3704	4860	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
"C:\Users\Admin\AppData\Local\Temp\0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:2836

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2636

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:4736

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:4272

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
- Modifies Internet Explorer settings
PID:5088

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
- Modifies Internet Explorer settings
PID:4560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 31A7BBB77496D089C081A4B2129F810E
2⤵
- Loads dropped DLL
PID:4672

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 2EC7A3E9DC29AA85F3D4C2B051C9C133
2⤵
- Loads dropped DLL
PID:3704

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Direct Volume Access

T1006

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-1DC4A173.[[email protected]].ccd
Filesize
23.5MB

MD5
b06055974b3d2bbeb7e25618982e95f6

SHA1
fa7b360273614b701c7f71b4bc43adda45f744b2

SHA256
a5f6688b38864422b82ac8eb02b5edc00d88220b2652f6fde79272a039d2f286

SHA512
cfbee0220e5464bd2f4c81e62260caf822c5eae4532ecb39899acc2e8aff6402a5e5c07e1d9f8dc9c2eb978b658c233a4cc512afe883035c843758d72f915e3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Filesize
7KB

MD5
03e95d22eea91e70a5801a0a559a734b

SHA1
08e07c95adcbc19df0d84a2bfbaab941ebf1977e

SHA256
3db3f784eb53ea8a820148347d723775d4e72c2803b9e661635d417f39d0547a

SHA512
5065d7f49eb1695ff2be1cd50de89223dcb5330346b4072f1478c572eb8279aef961e20315e6157d848c6e834c253f5381620bff225762f1f0f86cf205faa723

Download Submit
C:\Windows\Installer\MSI10C3.tmp
Filesize
257KB

MD5
d1f5ce6b23351677e54a245f46a9f8d2

SHA1
0d5c6749401248284767f16df92b726e727718ca

SHA256
57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

SHA512
960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

Download Submit
C:\Windows\Installer\MSI1420.tmp
Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI14BE.tmp
Filesize
148KB

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
\Windows\Installer\MSI118F.tmp
Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
\Windows\Installer\MSI181A.tmp
Filesize
86KB

MD5
ff58cd07bf4913ef899efd2dfb112553

SHA1
f14c1681de808543071602f17a6299f8b4ba2ae8

SHA256
1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

SHA512
23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads