dharma | 58e30f939535c1c2d65fbab197f4a6816931522b8513d8261154eb86f6e28579

Analysis

max time kernel
136s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7.exe
Size

397KB
MD5

60c40af102c485d0464236fe672d302b
SHA1

d4a5a0dae3fb0274c48828e84ff8f960c7463406
SHA256

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad
SHA512

4d22a012d1da6878e3a1f0a726a303084e1f775281f7518bf6712eb80b8fbbf5ef4c659a4be5d8e53ad9c2e0005ec8a3454491dcae4c517f4db7a81fcbad0dac
SSDEEP

6144:34OusAhTGvRi52AHAio3Ez2Ual3kYqUXK19KfFxmrAEkmB0aiA5:IOk8Q52qAio3ECXQfMfForBku0aiY

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 5642763B In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

Processes:

7.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	7.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7.exe	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	7.exe

Loads dropped DLL 2 IoCs

Processes:

taskmgr.exe

pid	Process
1112	taskmgr.exe
1112	taskmgr.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7.exe = "C:\\Windows\\System32\\7.exe"	7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	7.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

7.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QMPQWRBT\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	7.exe
File opened for modification	C:\Program Files\desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	7.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AQYH36ZT\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	7.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	7.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	7.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	7.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	7.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BY17T927\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	7.exe
File opened for modification	C:\Users\Public\desktop.ini	7.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\39RANI6K\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	7.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	7.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini	7.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	7.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	7.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	7.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T1DP8V76\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UGWF8QWZ\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	7.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	7.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U3EGUGI8\desktop.ini	7.exe

Drops file in System32 directory 2 IoCs

Processes:

7.exe

description	ioc	Process
File created	C:\Windows\System32\7.exe	7.exe
File created	C:\Windows\System32\Info.hta	7.exe

Drops file in Program Files directory 64 IoCs

Processes:

7.exe

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox	7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.HTM	7.exe
File opened for modification	C:\Program Files\MeasureOut.MTS.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WHIRL2.WMF	7.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB3B.BDR.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)greenStateIcon.png	7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar	7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSSOAPR3.DLL	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp	7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar	7.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFRES.CFG.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21548_.GIF.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu	7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03257_.WMF.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183328.WMF.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Premium.gif.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\clock.js	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBARBLL.XML	7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files\Java\jre7\lib\zi\PST8PDT.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ar.dll	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV_K_COL.HXK	7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png	7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\THMBNAIL.PNG	7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar	7.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02265_.WMF	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15132_.GIF	7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png	7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\QUIKPUBS.POC.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\MpEvMsg.dll.mui	7.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\currency.css	7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107722.WMF.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\PAPYRUS.ELM	7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png	7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota	7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar	7.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac	7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\gadget.xml	7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE06450_.WMF.id-5642763B.[[email protected]].combo	7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00241_.WMF.id-5642763B.[[email protected]].combo	7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif.id-5642763B.[[email protected]].combo	7.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exevssadmin.exe

pid	Process
2132	vssadmin.exe
2528	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7.exetaskmgr.exe

pid	Process
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe
1984	7.exe
1984	7.exe
1112	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid	Process
1112	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vssvc.exetaskmgr.exe

description	pid	Process
Token: SeBackupPrivilege	1044	vssvc.exe
Token: SeRestorePrivilege	1044	vssvc.exe
Token: SeAuditPrivilege	1044	vssvc.exe
Token: SeDebugPrivilege	1112	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	Process
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	Process
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

7.execmd.execmd.exe

description	pid	Process	procid_target
PID 1984 wrote to memory of 2944	1984	7.exe	31
PID 1984 wrote to memory of 2944	1984	7.exe	31
PID 1984 wrote to memory of 2944	1984	7.exe	31
PID 1984 wrote to memory of 2944	1984	7.exe	31
PID 2944 wrote to memory of 2164	2944	cmd.exe	33
PID 2944 wrote to memory of 2164	2944	cmd.exe	33
PID 2944 wrote to memory of 2164	2944	cmd.exe	33
PID 2944 wrote to memory of 2132	2944	cmd.exe	34
PID 2944 wrote to memory of 2132	2944	cmd.exe	34
PID 2944 wrote to memory of 2132	2944	cmd.exe	34
PID 1984 wrote to memory of 1556	1984	7.exe	39
PID 1984 wrote to memory of 1556	1984	7.exe	39
PID 1984 wrote to memory of 1556	1984	7.exe	39
PID 1984 wrote to memory of 1556	1984	7.exe	39
PID 1556 wrote to memory of 1732	1556	cmd.exe	41
PID 1556 wrote to memory of 1732	1556	cmd.exe	41
PID 1556 wrote to memory of 1732	1556	cmd.exe	41
PID 1556 wrote to memory of 2528	1556	cmd.exe	42
PID 1556 wrote to memory of 2528	1556	cmd.exe	42
PID 1556 wrote to memory of 2528	1556	cmd.exe	42
PID 1984 wrote to memory of 752	1984	7.exe	43
PID 1984 wrote to memory of 752	1984	7.exe	43
PID 1984 wrote to memory of 752	1984	7.exe	43
PID 1984 wrote to memory of 752	1984	7.exe	43
PID 1984 wrote to memory of 200	1984	7.exe	44
PID 1984 wrote to memory of 200	1984	7.exe	44
PID 1984 wrote to memory of 200	1984	7.exe	44
PID 1984 wrote to memory of 200	1984	7.exe	44

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:2164
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2132
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:1732
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2528
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:752
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-5642763B.[[email protected]].combo

Filesize
23.5MB

MD5
f744727a7adf9e271a3ac1b7dc8650c3

SHA1
3fe4646604fbe233da1ed7d5904632173765345e

SHA256
971a9f872ffd2959a9cde34f856101e907ce6ddd7ccf0f7dc56ad4d95f90105b

SHA512
be057ad497c8fef25a9b3bb4dda8cc0662a7da330663eae76873352dd1f5d366b6d6e1267cf7dbad25006ad5a52a731255020b89cecd2cfba841b81a11505d3d

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
04e2cbb9423c42dd77cfd614c4a36807

SHA1
8b6563ae67415b613703bbda83e77473cb82392f

SHA256
b6c846fa3267cedcd88b4fd97b1b9d88d3f86c24cc17cc6330030e5263ce35f9

SHA512
ed3d82b89dc4e5dac37d83bd50f5158170eb60f0feec2f79e8c8e1a2e7528fd67e32798b355635bef76d850594ab31977bf9c6657d43719441b5c663623e2b63

Download Submit
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
4.7MB

MD5
61bffb5f57ad12f83ab64b7181829b34

SHA1
945d94fef51e0db76c2fd95ee22ed2767be0fe0b

SHA256
1dd0dd35e4158f95765ee6639f217df03a0a19e624e020dba609268c08a13846

SHA512
e569639d3bb81a7b3bd46484ff4b8065d7fd15df416602d825443b2b17d8c0c59500fb6516118e7a65ea9fdd9e4be238f0319577fa44c114eaca18b0334ba521

Download Submit
memory/752-20346-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

Filesize
64KB

Download
memory/1112-14204-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-20328-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-20352-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-20351-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-20349-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-20348-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-20329-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-14183-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-3884-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-3926-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-5163-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-13726-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-5233-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-10649-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1112-13725-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1984-5169-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1984-2-0x00000000027B0000-0x0000000002BC0000-memory.dmp

Filesize
4.1MB

Download
memory/1984-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1984-3-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1984-5-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1984-4-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1984-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1984-9-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1984-8-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1984-7-0x00000000027B0000-0x0000000002BC0000-memory.dmp

Filesize
4.1MB

Download
memory/1984-6-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download