Resubmissions

12-05-2023 13:34

230512-qvjbpadc48 10

08-05-2023 17:48

230508-wdvw2sdf6v 10

General

  • Target

    VirusShare_5c36e305d926e55ef98d392176890cd2

  • Size

    1.0MB

  • Sample

    230512-qvjbpadc48

  • MD5

    5c36e305d926e55ef98d392176890cd2

  • SHA1

    64a15cdf89b6c8b85cba355b6944074614d810fd

  • SHA256

    5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

  • SHA512

    082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

  • SSDEEP

    24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

Malware Config

Extracted

Path

C:\info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail decryptioner@uncryptfile.com Write this ID in the title of your message 32B7E671 In case of no answer in 24 hours write us to theese e-mails: decoder@firemail.cc You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

decryptioner@uncryptfile.com

decoder@firemail.cc

Targets

    • Target

      VirusShare_5c36e305d926e55ef98d392176890cd2

    • Size

      1.0MB

    • MD5

      5c36e305d926e55ef98d392176890cd2

    • SHA1

      64a15cdf89b6c8b85cba355b6944074614d810fd

    • SHA256

      5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

    • SHA512

      082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

    • SSDEEP

      24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Disables Task Manager via registry modification

    • Disables taskbar notifications via registry modification

    • Disables use of System Restore points

    • Drops startup file

    • Modifies file permissions

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Hidden Files and Directories

1
T1158

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Indicator Removal on Host

1
T1070

File Deletion

3
T1107

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

5
T1490

Tasks