dharma | 970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4 | Triage

Submit
Reports

Overview

overview

Static

static

8

970959bc3a...f4.exe

windows7-x64

970959bc3a...f4.exe

windows10-2004-x64

Sharing

General

Target

970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4
Size

420KB
Sample

220731-f29gcaaec5
MD5

859553e76bcfb7c19bbf1ad1290b360c
SHA1

6a71def09b4b0058ca6f0b077a93c22b4eb63082
SHA256

970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4
SHA512

100dc319e1082da1f4a2d779642c785a89b2e00272ee85390c4cdcaa589ed0091eacdda5fc06ac9a87ea025b4fe0be62323ba51bd34b7968d96d8859f0676d2b

Score

10^/10

dharma persistence ransomware upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4.exe

Resource

win7-20220715-en

dharma persistence ransomware upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4.exe

Resource

win10v2004-20220721-en

dharma persistence ransomware upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4
- Size
  
  420KB
- MD5
  
  859553e76bcfb7c19bbf1ad1290b360c
- SHA1
  
  6a71def09b4b0058ca6f0b077a93c22b4eb63082
- SHA256
  
  970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4
- SHA512
  
  100dc319e1082da1f4a2d779642c785a89b2e00272ee85390c4cdcaa589ed0091eacdda5fc06ac9a87ea025b4fe0be62323ba51bd34b7968d96d8859f0676d2b
Score

10^/10

dharma persistence ransomware upx
- Dharma
  Dharma is a ransomware that uses security software installation to hide malicious activities.
  ransomware dharma
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

dharmapersistenceransomwareupx

behavioral2

dharmapersistenceransomwareupx

© 2018-2024

Terms | Privacy