General
-
Target
a5de5b0e2a1da6e958955c189db72467ec0f8daaa9f9f5ccc44e71c6c5d8add4.sample
-
Size
14.1MB
-
Sample
210726-kyc1r6kqfj
-
MD5
d35fa59ce558fe08955ce0e807ce07d0
-
SHA1
3fa0e015acddad634f9f362099f3d79683159726
-
SHA256
a5de5b0e2a1da6e958955c189db72467ec0f8daaa9f9f5ccc44e71c6c5d8add4
-
SHA512
b1965eea1ed6c77979c79acf893cd2ac2dbfa898b870f76d9ab59936ac5cf5c0995db9d98addfa72e6c1b2b304d6b021b9be89458a5b82ea6ff9f5014c8f9d0b
Static task
static1
Behavioral task
behavioral1
Sample
a5de5b0e2a1da6e958955c189db72467ec0f8daaa9f9f5ccc44e71c6c5d8add4.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
a5de5b0e2a1da6e958955c189db72467ec0f8daaa9f9f5ccc44e71c6c5d8add4.sample.exe
Resource
win10v20210410
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Enigma1crypt@aol.com
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Enigma1crypt@aol.com
Targets
-
-
Target
a5de5b0e2a1da6e958955c189db72467ec0f8daaa9f9f5ccc44e71c6c5d8add4.sample
-
Size
14.1MB
-
MD5
d35fa59ce558fe08955ce0e807ce07d0
-
SHA1
3fa0e015acddad634f9f362099f3d79683159726
-
SHA256
a5de5b0e2a1da6e958955c189db72467ec0f8daaa9f9f5ccc44e71c6c5d8add4
-
SHA512
b1965eea1ed6c77979c79acf893cd2ac2dbfa898b870f76d9ab59936ac5cf5c0995db9d98addfa72e6c1b2b304d6b021b9be89458a5b82ea6ff9f5014c8f9d0b
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets file execution options in registry
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-