Overview

overview

10

Static

static

5c40efc5d6...63.exe

windows7_x64

10

5c40efc5d6...63.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    05-03-2022 19:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c40efc5d62c055eba9a2679d660d3cd4315358a63c396f3baecc27da1eed363.exe

  • Size

    92KB

  • MD5

    e874441b0e0c0fa908b9ee2b4fcc91e9

  • SHA1

    13defa034619bf14c1b64a485c9b37e3b20cc1c1

  • SHA256

    5c40efc5d62c055eba9a2679d660d3cd4315358a63c396f3baecc27da1eed363

  • SHA512

    46776eda623f59aa91a4ece0ff55d687e714a7f2132b197f8ef639f2ccfd4205f589106b541fde5a598fba2881fac7f5b44110872c006fa8d803692a206d92d8

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c40efc5d62c055eba9a2679d660d3cd4315358a63c396f3baecc27da1eed363.exe
    "C:\Users\Admin\AppData\Local\Temp\5c40efc5d62c055eba9a2679d660d3cd4315358a63c396f3baecc27da1eed363.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:3852
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:4528
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4768
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:684
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:756
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
            PID:632
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:1632
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4624
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
            1⤵
            • Modifies data under HKEY_USERS
            PID:2388

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
            MD5

            9588ae73967b4f95f8a7110a49bac2b7

            SHA1

            777e320f4c68e1259d739f21caf14db28b2cebc4

            SHA256

            209ba84adcb8e01eddb416d1ddb04aacb6bd0f48f8db581a0b7260c40b1e1dc1

            SHA512

            61a2cbc8e9dcbbc31bfbd7073eaebea2fe7750d3de348852249a96dd57c127012ec194f53a6ce90bebc0bc9e31f992dfd0064289e71ee1ccae5084d8ba245340

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
            MD5

            9588ae73967b4f95f8a7110a49bac2b7

            SHA1

            777e320f4c68e1259d739f21caf14db28b2cebc4

            SHA256

            209ba84adcb8e01eddb416d1ddb04aacb6bd0f48f8db581a0b7260c40b1e1dc1

            SHA512

            61a2cbc8e9dcbbc31bfbd7073eaebea2fe7750d3de348852249a96dd57c127012ec194f53a6ce90bebc0bc9e31f992dfd0064289e71ee1ccae5084d8ba245340

            Download Submit
          • memory/2388-134-0x0000015284940000-0x0000015284950000-memory.dmp
            Filesize

            64KB

            Download
          • memory/2388-135-0x0000015285520000-0x0000015285530000-memory.dmp
            Filesize

            64KB

            Download
          • memory/2388-136-0x00000152855E0000-0x00000152855E1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2388-137-0x00000152855E0000-0x00000152855E1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2388-138-0x00000152878B0000-0x00000152878B4000-memory.dmp
            Filesize

            16KB

            Download