General
-
Target
dharma.exe
-
Size
70KB
-
Sample
210722-mmfchafls6
-
MD5
d65c7db4797b4738e91d0a24444033a6
-
SHA1
b524a9b5a3abebbc04c068897b69515e5a1f26ac
-
SHA256
883162246c3d0a2c10e5c35a2a43ff444a24dbcf9e64dc5cc09009b9cd0ab48e
-
SHA512
aee796aaea06081d45dc0495a736d697fb6bd3ed8f34ca2efb8fff6919311942db3aeb196c56276ae048a018c9c0827d66e319362e3402dfadd4558bfa2c88e3
Static task
static1
Behavioral task
behavioral1
Sample
dharma.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
dharma.exe
Resource
win10v20210410
Malware Config
Extracted
C:\info.hta
maksimbockovskij315@gmail.com
maksimbockovskij@tuta.io
Extracted
C:\users\public\desktop\info.hta
maksimbockovskij315@gmail.com
maksimbockovskij@tuta.io
Targets
-
-
Target
dharma.exe
-
Size
70KB
-
MD5
d65c7db4797b4738e91d0a24444033a6
-
SHA1
b524a9b5a3abebbc04c068897b69515e5a1f26ac
-
SHA256
883162246c3d0a2c10e5c35a2a43ff444a24dbcf9e64dc5cc09009b9cd0ab48e
-
SHA512
aee796aaea06081d45dc0495a736d697fb6bd3ed8f34ca2efb8fff6919311942db3aeb196c56276ae048a018c9c0827d66e319362e3402dfadd4558bfa2c88e3
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies boot configuration data using bcdedit
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-