Overview

overview

10

Static

static

07bb57628e...e6.exe

windows7_x64

10

07bb57628e...e6.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    156s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-05-2022 10:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6.exe

  • Size

    179KB

  • MD5

    895c44d17b2854a19b17620b6481bb7a

  • SHA1

    f6b2a812c3969004fa78a2b1f1e2b695a9564736

  • SHA256

    07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6

  • SHA512

    b70e027c07b6820d106cd17145ebf9e9909e6f359b9fac66121039be5e53dca49c15565bbd9e8e6de31eaf87491d9f216ea0dddc86ad30af4aaf96b0f281e0b4

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php or Telegram telegram_@spacedatax Your ID A545D3F8 Use Tor Browser to access this address. If you have not been answered via the link within 12 hours, write to us by e-mail: telegram_@spacedatax Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
URLs

http://dj55huaqbbsnhwngb5rgeq65ns3nteyon7wlp32gkamzs3k2ogrdr5qd.onion/chat.php

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6.exe
    "C:\Users\Admin\AppData\Local\Temp\07bb57628ec61e0bddcfd621e11069974f4fc3635a3b4990c600fd7d927220e6.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3572
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:4320
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2064
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:1072
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:4156
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
            PID:2936
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:1484
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2220

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
            Filesize

            7KB

            MD5

            91b447527498de56256ed23a547a282a

            SHA1

            86659f007a8a2fae818722c7a0b2cee63bd68922

            SHA256

            430d747472181fa97ef21c86bf39e2fda11d611cae8fb780aabbc8128f49ba49

            SHA512

            2d3b531646c4073112d775271b74c0954c5dadc2921c21535821f153d75b870746ab5b9d0167ee39eecd79a0fbc930ce47bceac45a779b31463b93204027789c

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
            Filesize

            7KB

            MD5

            91b447527498de56256ed23a547a282a

            SHA1

            86659f007a8a2fae818722c7a0b2cee63bd68922

            SHA256

            430d747472181fa97ef21c86bf39e2fda11d611cae8fb780aabbc8128f49ba49

            SHA512

            2d3b531646c4073112d775271b74c0954c5dadc2921c21535821f153d75b870746ab5b9d0167ee39eecd79a0fbc930ce47bceac45a779b31463b93204027789c

            Download Submit
          • memory/1072-137-0x0000000000000000-mapping.dmp
            Download
          • memory/1484-140-0x0000000000000000-mapping.dmp
            Download
          • memory/2064-135-0x0000000000000000-mapping.dmp
            Download
          • memory/2760-131-0x0000000003030000-0x0000000003049000-memory.dmp
            Filesize

            100KB

            Download
          • memory/2760-132-0x0000000000400000-0x0000000002FB8000-memory.dmp
            Filesize

            43.7MB

            Download
          • memory/2760-130-0x0000000003268000-0x000000000327B000-memory.dmp
            Filesize

            76KB

            Download
          • memory/2936-139-0x0000000000000000-mapping.dmp
            Download
          • memory/3572-133-0x0000000000000000-mapping.dmp
            Download
          • memory/4156-138-0x0000000000000000-mapping.dmp
            Download
          • memory/4320-134-0x0000000000000000-mapping.dmp
            Download
          • memory/4876-136-0x0000000000000000-mapping.dmp
            Download