Overview

overview

10

Static

static

dharma.exe

windows10-2004-x64

10

Resubmissions

23-10-2023 21:58

231023-1vlrxsgc2w 10

28-12-2022 20:03

221228-ys52nsbd89 10

28-12-2022 19:41

221228-yej72sbd64 10

28-12-2022 19:27

221228-x569tsbd43 10

Analysis

  • max time kernel
    256s
  • max time network
    257s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-12-2022 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dharma.exe

  • Size

    677KB

  • MD5

    2d4ec86793fec1e10ac8fb617b2dcdbd

  • SHA1

    078df2b23e7e24f2397532f9ec2694191fd9cc20

  • SHA256

    a6ed8beb599f2aa594298076a2e8312871a2b12feb8e5d072d51335f21f85d7b

  • SHA512

    1e15b4c910532ed36cf3adf605f744784224ceaa815e71588fb521f0e7b76975dc37889e6c8ac2e1c888060eda2380850c8877a801c74e222db043715719c5de

  • SSDEEP

    12288:5IODa1GPYOBsDMOUaIQpGyEV3T5W241YcWEhpEdVe1/4vS1ZoYGIRUafy5LT+0w:5IO+aYxHjpYT5s1YcWEhpEdVe1/4vS1T

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail admin@stex777.com Write this ID in the title of your message A4F56274 In case of no answer in 24 hours write us to theese e-mails: admin@stex777.xyz You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

admin@stex777.com

admin@stex777.xyz

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dharma.exe
    "C:\Users\Admin\AppData\Local\Temp\dharma.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3564
    • C:\Users\Admin\AppData\Local\Temp\dharma.exe
      C:\Users\Admin\AppData\Local\Temp\dharma.exe
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4600
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          4⤵
            PID:4376
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:1996
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3712
          • C:\Windows\system32\mode.com
            mode con cp select=1251
            4⤵
              PID:2364
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:296
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            3⤵
              PID:2000
            • C:\Windows\System32\mshta.exe
              "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
              3⤵
                PID:3432
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:396
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            1⤵
            • Drops startup file
            • Checks SCSI registry key(s)
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4312
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            1⤵
              PID:3340
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3144
              • C:\Windows\system32\mspaint.exe
                "C:\Windows\system32\mspaint.exe" "C:\Users\Public\Desktop\Google Chrome.lnk.id-A4F56274.[admin@stex777.com].money"
                2⤵
                • Drops file in Windows directory
                • Suspicious use of SetWindowsHookEx
                PID:4940
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
              1⤵
                PID:380

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              Defense Evasion

              File Deletion

              2
              T1107

              Modify Registry

              1
              T1112

              Credential Access

              Credentials in Files

              1
              T1081

              Discovery

              Query Registry

              3
              T1012

              System Information Discovery

              4
              T1082

              Peripheral Device Discovery

              1
              T1120

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Exfiltration

              Command and Control

              Impact

              Inhibit System Recovery

              2
              T1490

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
                Filesize

                13KB

                MD5

                125d104225b0f251f83c458b6da4e30f

                SHA1

                70425b3a9b793a6a9544ffab0afb0e529574e8ef

                SHA256

                5bac752ebff690977cf421cbffe5873d7e00977f1c840d1f5ef7b2876cd6eb1b

                SHA512

                8cf7bae12597a8a33eed44c777b103fb4747230fbb72ebf2e889909cda2119db9f852c5ff486839844b60659a96d2e8b4d4fb45111b52f22b4d8c7cf50e61b2e

                Download Submit
              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\dharma.exe
                Filesize

                677KB

                MD5

                2d4ec86793fec1e10ac8fb617b2dcdbd

                SHA1

                078df2b23e7e24f2397532f9ec2694191fd9cc20

                SHA256

                a6ed8beb599f2aa594298076a2e8312871a2b12feb8e5d072d51335f21f85d7b

                SHA512

                1e15b4c910532ed36cf3adf605f744784224ceaa815e71588fb521f0e7b76975dc37889e6c8ac2e1c888060eda2380850c8877a801c74e222db043715719c5de

                Download Submit
              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                MD5

                d41d8cd98f00b204e9800998ecf8427e

                SHA1

                da39a3ee5e6b4b0d3255bfef95601890afd80709

                SHA256

                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                SHA512

                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                Download Submit
              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                MD5

                d41d8cd98f00b204e9800998ecf8427e

                SHA1

                da39a3ee5e6b4b0d3255bfef95601890afd80709

                SHA256

                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                SHA512

                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                Download Submit
              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                MD5

                d41d8cd98f00b204e9800998ecf8427e

                SHA1

                da39a3ee5e6b4b0d3255bfef95601890afd80709

                SHA256

                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                SHA512

                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                Download Submit
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                Filesize

                28KB

                MD5

                5bc82a24bcd69d33722090ca3a7ac303

                SHA1

                b1eb04bd182ed38ff291bc70ade2fa3cfe87adb1

                SHA256

                b20a745b06c12c6159e91c9457a49a7241d67935ed3e0b361f94328db0c7daa8

                SHA512

                417cfdbc4db69ed748f4af00b0bf305248997f208df5e2a1e671d8355af4b93f44dfb9b032b1b0ff00419b73d732efcda747d5b4b348f788a50c2369185aff07

                Download Submit
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
                Filesize

                13KB

                MD5

                125d104225b0f251f83c458b6da4e30f

                SHA1

                70425b3a9b793a6a9544ffab0afb0e529574e8ef

                SHA256

                5bac752ebff690977cf421cbffe5873d7e00977f1c840d1f5ef7b2876cd6eb1b

                SHA512

                8cf7bae12597a8a33eed44c777b103fb4747230fbb72ebf2e889909cda2119db9f852c5ff486839844b60659a96d2e8b4d4fb45111b52f22b4d8c7cf50e61b2e

                Download Submit
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dharma.exe
                Filesize

                677KB

                MD5

                2d4ec86793fec1e10ac8fb617b2dcdbd

                SHA1

                078df2b23e7e24f2397532f9ec2694191fd9cc20

                SHA256

                a6ed8beb599f2aa594298076a2e8312871a2b12feb8e5d072d51335f21f85d7b

                SHA512

                1e15b4c910532ed36cf3adf605f744784224ceaa815e71588fb521f0e7b76975dc37889e6c8ac2e1c888060eda2380850c8877a801c74e222db043715719c5de

                Download Submit
              • C:\Users\Public\Desktop\Google Chrome.lnk.id-A4F56274.[admin@stex777.com].money
                Filesize

                2KB

                MD5

                ac9c88ff919b611d0c7a8849a80dda02

                SHA1

                787cba66fac4170c1ac1cfdab9dd62a2b0d636f7

                SHA256

                e2c8d62235c51a67babf22aad043b85070902ecc487418f01cbd61f67650b160

                SHA512

                b8688fc04ec968301a3d16f7cd6120d49d21be2e416305f36f3d90b9b72e9145123c5141d48d694c03df36002c2b0df3a57b00f22c5d26f6aeafe254fe256816

                Download Submit
              • C:\Windows\System32\dharma.exe
                Filesize

                677KB

                MD5

                2d4ec86793fec1e10ac8fb617b2dcdbd

                SHA1

                078df2b23e7e24f2397532f9ec2694191fd9cc20

                SHA256

                a6ed8beb599f2aa594298076a2e8312871a2b12feb8e5d072d51335f21f85d7b

                SHA512

                1e15b4c910532ed36cf3adf605f744784224ceaa815e71588fb521f0e7b76975dc37889e6c8ac2e1c888060eda2380850c8877a801c74e222db043715719c5de

                Download Submit
              • memory/296-159-0x0000000000000000-mapping.dmp
                Download
              • memory/1804-134-0x0000000000400000-0x0000000000419000-memory.dmp
                Filesize

                100KB

                Download
              • memory/1804-133-0x0000000000000000-mapping.dmp
                Download
              • memory/1804-139-0x0000000000400000-0x0000000000419000-memory.dmp
                Filesize

                100KB

                Download
              • memory/1996-143-0x0000000000000000-mapping.dmp
                Download
              • memory/2000-154-0x0000000000000000-mapping.dmp
                Download
              • memory/2364-153-0x0000000000000000-mapping.dmp
                Download
              • memory/3432-156-0x0000000000000000-mapping.dmp
                Download
              • memory/3564-132-0x00000000029B0000-0x00000000029E3000-memory.dmp
                Filesize

                204KB

                Download
              • memory/3564-141-0x00000000029B0000-0x00000000029E3000-memory.dmp
                Filesize

                204KB

                Download
              • memory/3712-151-0x0000000000000000-mapping.dmp
                Download
              • memory/4376-142-0x0000000000000000-mapping.dmp
                Download
              • memory/4600-140-0x0000000000000000-mapping.dmp
                Download
              • memory/4940-161-0x0000000000000000-mapping.dmp
                Download