Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
suck my dik niger.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
suck my dik niger.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
suck my dik niger.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
suck my dik niger.exe
Resource
win11-20241007-en
General
-
Target
suck my dik niger.exe
-
Size
92KB
-
MD5
c2ec717719cc20e4527e5a4b43e48eb5
-
SHA1
9f6bac7a8ab1a95922aa0a19b8b99b5dd60ac916
-
SHA256
a1f3a173379286a85de310dc648c9040453571b130c63528f7856d1c3c8f0142
-
SHA512
400caf22baa9c249055e876d4751ec010ee2f1e45b07c922a12304b4965e9032b2553f33c59c7885bbdd8cc6ab55c19f80c15e16f3e0526d974630b47cfd9ec2
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AnOgzSn7V84yIHAM/PatiR52gIlJ:Qw+asqN5aW/hLR7z0iIgqaK5
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (321) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta suck my dik niger.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\suck my dik niger.exe suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini suck my dik niger.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-0E392D11.[[email protected]].gamma suck my dik niger.exe -
Loads dropped DLL 8 IoCs
pid Process 2752 MsiExec.exe 2752 MsiExec.exe 2752 MsiExec.exe 2752 MsiExec.exe 2752 MsiExec.exe 2752 MsiExec.exe 2752 MsiExec.exe 2188 MsiExec.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suck my dik niger.exe = "C:\\Windows\\System32\\suck my dik niger.exe" suck my dik niger.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" suck my dik niger.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" suck my dik niger.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Links\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Desktop\desktop.ini suck my dik niger.exe File opened for modification C:\Program Files\desktop.ini suck my dik niger.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini suck my dik niger.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Pictures\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Music\desktop.ini suck my dik niger.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini suck my dik niger.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\60QKHYE2\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini suck my dik niger.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BAFOJIJD\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini suck my dik niger.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini suck my dik niger.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini suck my dik niger.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Videos\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Downloads\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Documents\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Searches\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini suck my dik niger.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI suck my dik niger.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini suck my dik niger.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini suck my dik niger.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Music\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Videos\desktop.ini suck my dik niger.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini suck my dik niger.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\09OB1FV8\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini suck my dik niger.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini suck my dik niger.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini suck my dik niger.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini suck my dik niger.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\suck my dik niger.exe suck my dik niger.exe File created C:\Windows\System32\Info.hta suck my dik niger.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll suck my dik niger.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\HICCUP.WAV suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml suck my dik niger.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF suck my dik niger.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png suck my dik niger.exe File created C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00090_.GIF.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msader15.dll suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\IPEDINTL.DLL suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_en.dub.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME54.CSS.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png suck my dik niger.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar suck my dik niger.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18203_.WMF suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Premium.css.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak suck my dik niger.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Traditional.dotx.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml suck my dik niger.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02227_.WMF suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\MLA.XSL suck my dik niger.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc suck my dik niger.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01590_.WMF suck my dik niger.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Solstice.xml.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt suck my dik niger.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui suck my dik niger.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZMAIN.ACCDE.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18227_.WMF.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.Infopath.dll.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png suck my dik niger.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL082.XML suck my dik niger.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099154.JPG suck my dik niger.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN105.XML.id-0E392D11.[[email protected]].gamma suck my dik niger.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDREQS.ICO.id-0E392D11.[[email protected]].gamma suck my dik niger.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f76f71b.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIF845.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFAB7.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIFD47.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFF2B.tmp msiexec.exe File created C:\Windows\Installer\f76f71b.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIF8D2.tmp msiexec.exe File created C:\Windows\Installer\f76f71e.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIFF4C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFFC9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF75A.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language suck my dik niger.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2148 vssadmin.exe 4664 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry class 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 3468 msiexec.exe 3468 msiexec.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe 2584 suck my dik niger.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeBackupPrivilege 2672 vssvc.exe Token: SeRestorePrivilege 2672 vssvc.exe Token: SeAuditPrivilege 2672 vssvc.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeSecurityPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe Token: SeRestorePrivilege 3468 msiexec.exe Token: SeTakeOwnershipPrivilege 3468 msiexec.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2292 2584 suck my dik niger.exe 30 PID 2584 wrote to memory of 2292 2584 suck my dik niger.exe 30 PID 2584 wrote to memory of 2292 2584 suck my dik niger.exe 30 PID 2584 wrote to memory of 2292 2584 suck my dik niger.exe 30 PID 2292 wrote to memory of 1756 2292 cmd.exe 32 PID 2292 wrote to memory of 1756 2292 cmd.exe 32 PID 2292 wrote to memory of 1756 2292 cmd.exe 32 PID 2292 wrote to memory of 2148 2292 cmd.exe 33 PID 2292 wrote to memory of 2148 2292 cmd.exe 33 PID 2292 wrote to memory of 2148 2292 cmd.exe 33 PID 3468 wrote to memory of 2752 3468 msiexec.exe 39 PID 3468 wrote to memory of 2752 3468 msiexec.exe 39 PID 3468 wrote to memory of 2752 3468 msiexec.exe 39 PID 3468 wrote to memory of 2752 3468 msiexec.exe 39 PID 3468 wrote to memory of 2752 3468 msiexec.exe 39 PID 3468 wrote to memory of 2752 3468 msiexec.exe 39 PID 3468 wrote to memory of 2752 3468 msiexec.exe 39 PID 2584 wrote to memory of 2724 2584 suck my dik niger.exe 40 PID 2584 wrote to memory of 2724 2584 suck my dik niger.exe 40 PID 2584 wrote to memory of 2724 2584 suck my dik niger.exe 40 PID 2584 wrote to memory of 2724 2584 suck my dik niger.exe 40 PID 2724 wrote to memory of 2436 2724 cmd.exe 42 PID 2724 wrote to memory of 2436 2724 cmd.exe 42 PID 2724 wrote to memory of 2436 2724 cmd.exe 42 PID 2724 wrote to memory of 4664 2724 cmd.exe 43 PID 2724 wrote to memory of 4664 2724 cmd.exe 43 PID 2724 wrote to memory of 4664 2724 cmd.exe 43 PID 2584 wrote to memory of 4652 2584 suck my dik niger.exe 44 PID 2584 wrote to memory of 4652 2584 suck my dik niger.exe 44 PID 2584 wrote to memory of 4652 2584 suck my dik niger.exe 44 PID 2584 wrote to memory of 4652 2584 suck my dik niger.exe 44 PID 2584 wrote to memory of 3108 2584 suck my dik niger.exe 45 PID 2584 wrote to memory of 3108 2584 suck my dik niger.exe 45 PID 2584 wrote to memory of 3108 2584 suck my dik niger.exe 45 PID 2584 wrote to memory of 3108 2584 suck my dik niger.exe 45 PID 3468 wrote to memory of 2188 3468 msiexec.exe 46 PID 3468 wrote to memory of 2188 3468 msiexec.exe 46 PID 3468 wrote to memory of 2188 3468 msiexec.exe 46 PID 3468 wrote to memory of 2188 3468 msiexec.exe 46 PID 3468 wrote to memory of 2188 3468 msiexec.exe 46 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\suck my dik niger.exe"C:\Users\Admin\AppData\Local\Temp\suck my dik niger.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1756
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2148
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2436
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4664
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:4652
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3108
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85C0DBAAC4275F12C73206E917532CA32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2752
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 5CD0C927715774DB152438E918995EE52⤵
- Loads dropped DLL
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-0E392D11.[[email protected]].gamma
Filesize23.5MB
MD5ef4c1c4b00e3f48e1d2168d917abf2b1
SHA1e15026f53981c939d603d04d33e45bbf2b65658d
SHA256346b92bf7bd072320bf08d48de7638c7a9beab4b21651b2c14b43a7bdae019ec
SHA5122fbb757a92bbd6af913d54ff007a4cde6af2a0b0676ad2863ad57fc64b5e8daed379da67f85db7c45122f056aa59aa74165697e48db9db9c31eb756670ae2bdf
-
Filesize
13KB
MD5cb430519d1b31a000f8cf37e6f1cbcbf
SHA163e74fd3bb70ff4eac88e878717bacdbc3844dc8
SHA256128dbdd6309d9c1e54648a89df3d24d2dcbd31a3087eb12221958d5bc0fb2bda
SHA5127971a764ee3bc2c328e61f8fed90a56f753e8bec87927a1d060d1d0e9b844d105a325e04607333daafd3965075292bf2230ea2962ccf664851fb1ee4cc2606f1
-
Filesize
86KB
MD5ff58cd07bf4913ef899efd2dfb112553
SHA1f14c1681de808543071602f17a6299f8b4ba2ae8
SHA2561afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA51223e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
148KB
MD533908aa43ac0aaabc06a58d51b1c2cca
SHA10a0d1ce3435abe2eed635481bac69e1999031291
SHA2564447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d