dharma | 58e30f939535c1c2d65fbab197f4a6816931522b8513d8261154eb86f6e28579

Analysis

max time kernel
127s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
Size

397KB
MD5

60c40af102c485d0464236fe672d302b
SHA1

d4a5a0dae3fb0274c48828e84ff8f960c7463406
SHA256

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad
SHA512

4d22a012d1da6878e3a1f0a726a303084e1f775281f7518bf6712eb80b8fbbf5ef4c659a4be5d8e53ad9c2e0005ec8a3454491dcae4c517f4db7a81fcbad0dac
SSDEEP

6144:34OusAhTGvRi52AHAio3Ez2Ual3kYqUXK19KfFxmrAEkmB0aiA5:IOk8Q52qAio3ECXQfMfForBku0aiY

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message C90EE6FF In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (326) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

Processes:

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

Loads dropped DLL 8 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid process

4016 MsiExec.exe
4016 MsiExec.exe
4016 MsiExec.exe
4016 MsiExec.exe
4016 MsiExec.exe
4016 MsiExec.exe
4016 MsiExec.exe
3016 MsiExec.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
4016	MsiExec.exe
4016	MsiExec.exe
4016	MsiExec.exe
4016	MsiExec.exe
4016	MsiExec.exe
4016	MsiExec.exe
4016	MsiExec.exe
3016	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe = "C:\\Windows\\System32\\287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe"	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RM4QEUM4\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8NROS34R\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HWUYADN5\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WY6T2DFU\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HE9LBEC2\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in System32 directory 2 IoCs

Processes:

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

description	ioc	process
File created	C:\Windows\System32\287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Windows\System32\Info.hta	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

Drops file in Program Files directory 64 IoCs

Processes:

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCAL.DPV	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCINFO.XML.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\IntroducingPowerPoint2010.potx.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241773.WMF	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR41F.GIF.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Moncton.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304405.WMF.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21316_.GIF.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02233_.WMF.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18209_.WMF.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOML.ICO.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\TexturedBlue.css	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35B.GIF	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30B.GIF.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\REFEDIT.DLL.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\oledbvbs.inc	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ACTIP10.HLP.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Nipigon	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14845_.GIF	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\Attachments.jpg.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOCL.ICO.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RSPMECH.POC.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FORM.JS.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Stock Quotes.iqy.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185796.WMF.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\PREVIEW.GIF	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04108_.WMF.id-C90EE6FF.[[email protected]].combo	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIB654.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB915.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA2F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB99.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB74F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7BD.tmp	msiexec.exe
File created	C:\Windows\Installer\f77b609.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f77b606.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE67.tmp	msiexec.exe
File created	C:\Windows\Installer\f77b606.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBADC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f77b609.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exeMsiExec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

548 vssadmin.exe
2904 vssadmin.exe

pid	process
548	vssadmin.exe
2904	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 20 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\xmlfile\shell\edit\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command\ = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE\" /verb edit \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon\ = "\"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\xmlfile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\xmlfile\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler\ = "{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\xmlfile\shell\edit	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command\ = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE\" /verb open \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\xmlfile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\xmlfile\ShellEx\IconHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exemsiexec.exe

pid	process
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
3600	msiexec.exe
3600	msiexec.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

vssvc.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	3064	vssvc.exe
Token: SeRestorePrivilege	3064	vssvc.exe
Token: SeAuditPrivilege	3064	vssvc.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeSecurityPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe
Token: SeRestorePrivilege	3600	msiexec.exe
Token: SeTakeOwnershipPrivilege	3600	msiexec.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.execmd.execmd.exemsiexec.exe

description	pid	process	target process
PID 1980 wrote to memory of 3000	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	cmd.exe
PID 1980 wrote to memory of 3000	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	cmd.exe
PID 1980 wrote to memory of 3000	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	cmd.exe
PID 1980 wrote to memory of 3000	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	cmd.exe
PID 3000 wrote to memory of 2600	3000	cmd.exe	mode.com
PID 3000 wrote to memory of 2600	3000	cmd.exe	mode.com
PID 3000 wrote to memory of 2600	3000	cmd.exe	mode.com
PID 3000 wrote to memory of 548	3000	cmd.exe	vssadmin.exe
PID 3000 wrote to memory of 548	3000	cmd.exe	vssadmin.exe
PID 3000 wrote to memory of 548	3000	cmd.exe	vssadmin.exe
PID 1980 wrote to memory of 2484	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	cmd.exe
PID 1980 wrote to memory of 2484	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	cmd.exe
PID 1980 wrote to memory of 2484	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	cmd.exe
PID 1980 wrote to memory of 2484	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	cmd.exe
PID 2484 wrote to memory of 3420	2484	cmd.exe	mode.com
PID 2484 wrote to memory of 3420	2484	cmd.exe	mode.com
PID 2484 wrote to memory of 3420	2484	cmd.exe	mode.com
PID 2484 wrote to memory of 2904	2484	cmd.exe	vssadmin.exe
PID 2484 wrote to memory of 2904	2484	cmd.exe	vssadmin.exe
PID 2484 wrote to memory of 2904	2484	cmd.exe	vssadmin.exe
PID 3600 wrote to memory of 4016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 4016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 4016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 4016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 4016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 4016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 4016	3600	msiexec.exe	MsiExec.exe
PID 1980 wrote to memory of 3792	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	mshta.exe
PID 1980 wrote to memory of 3792	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	mshta.exe
PID 1980 wrote to memory of 3792	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	mshta.exe
PID 1980 wrote to memory of 3792	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	mshta.exe
PID 1980 wrote to memory of 3448	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	mshta.exe
PID 1980 wrote to memory of 3448	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	mshta.exe
PID 1980 wrote to memory of 3448	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	mshta.exe
PID 1980 wrote to memory of 3448	1980	287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe	mshta.exe
PID 3600 wrote to memory of 3016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 3016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 3016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 3016	3600	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 3016	3600	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe
"C:\Users\Admin\AppData\Local\Temp\287a6b75d1776f89502a1fd0ec571adebff878becb0ebdcec703e8fc6e3885ad.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:2600
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:548
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\mode.com
    mode con cp select=1251
    3⤵
    PID:3420
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2904
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3792
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:3448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 994622A13CAD5E85DBFC530EC259B7C0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4016
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding AD273474572024A5C9FC4E1812A4DFE6
  2⤵
  - Loads dropped DLL
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-C90EE6FF.[[email protected]].combo

Filesize
6.3MB

MD5
66e78656a6e897b0e03c55a91f2bec7f

SHA1
a63174af545755bbbfaa2d3297d0a73a998c940f

SHA256
71cf459041a6f94dbf5dffb056776f3c96441b695c886895b258c22e1c38957c

SHA512
ca5eaa15c36d1e185f2ecd220d272d2ff7a5959a36c9bdab6fa42390e861781acfe0430a7965a1b1c85a798c489c1c09fe0ce4ea23b6f40424abc955fbac89c7

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Filesize
13KB

MD5
9fb8d5671c989072b32ab2625e168da1

SHA1
bcf42ba59c0c950a931fee783ad05633a2788f60

SHA256
51d8c1a803b2158d125c8800ecea7e6a69abf09f529cd23acdc13aa1648bfcca

SHA512
14703cff52f74a4f85b0d9d783e37a60d0e9b0401bdc2be464e0b3e3bd2fd4ec163ba9d331f38b457cc8c0c51909cd4518192335da4c4509dc28b346aeec8973

Download Submit
C:\Windows\Installer\MSIB74F.tmp

Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\Windows\Installer\MSIBA2F.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSIBE67.tmp

Filesize
86KB

MD5
ff58cd07bf4913ef899efd2dfb112553

SHA1
f14c1681de808543071602f17a6299f8b4ba2ae8

SHA256
1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

SHA512
23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

Download Submit
\Windows\Installer\MSIB654.tmp

Filesize
257KB

MD5
d1f5ce6b23351677e54a245f46a9f8d2

SHA1
0d5c6749401248284767f16df92b726e727718ca

SHA256
57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

SHA512
960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

Download Submit
\Windows\Installer\MSIBB1B.tmp

Filesize
148KB

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
memory/1980-4-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1980-8-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1980-7-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1980-7731-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1980-6-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1980-5-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1980-0-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1980-2-0x0000000002710000-0x0000000002B20000-memory.dmp

Filesize
4.1MB

Download
memory/1980-3-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1980-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3792-20345-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

Filesize
64KB

Download