Overview

overview

10

Static

static

3

1dll.exe

windows7-x64

10

Resubmissions

10-10-2023 08:37

231010-kh9p8acb8x 10

22-05-2023 12:23

230522-pkjc9sgd25 10

Analysis

  • max time kernel
    142s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2023 12:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1dll.exe

  • Size

    92KB

  • MD5

    85e909a30b4ccbd76d9a1d0d689ce807

  • SHA1

    61cdf7aed6b2e5db0e88dd1cbb155bb1093ebd3b

  • SHA256

    f7ca01560b2b1fb8404a5cb1f6ec7251a38ca40c22fe4199bfeaaf1c25e520a1

  • SHA512

    a04f26a80c677d439f478d30e24b544501971c80a0cdd2f023268342daf8293776846c61230a275c0f9427319d848e5387861c7b93888bc0e505e2003cf06bbd

  • SSDEEP

    1536:mBwl+KXpsqN5vlwWYyhY9S4ACp81XCKq9e2T14VF992X4ZlFpEJ:Qw+asqN5aW/hL44A2HAIHEJ

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All FILES ENCRYPTED "RSA1024" All YOUR FILES HAVE BEEN ENCRYPTED!!! IF YOU WANT TO RESTORE THEM, WRITE US TO THE E-MAIL lockhelp@qq.com IN THE LETTER WRITE YOUR ID, YOUR ID 3F554453 IF YOU ARE NOT ANSWERED, WRITE TO EMAIL: lockhelp@qq.com YOUR SECRET KEY WILL BE STORED ON A SERVER 7 DAYS, AFTER 7 DAYS IT MAY BE OVERWRITTEN BY OTHER KEYS, DON'T PULL TIME, WAITING YOUR EMAIL FREE DECRYPTION FOR PROOF You can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) DECRYPTION PROCESS: When you make sure of decryption possibility transfer the money to our bitcoin wallet. As soon as we receive the money we will send you: 1. Decryption program. 2. Detailed instruction for decryption. 3. And individual keys for decrypting your files. !WARNING! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

lockhelp@qq.com

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (313) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 12 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dll.exe
    "C:\Users\Admin\AppData\Local\Temp\1dll.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:1692
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:1688
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:2812
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:2780
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:2704
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          PID:2592
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1236
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x250
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2776
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 86518EDEC05EC147A4F4A8C7F59B6003
          2⤵
          • Loads dropped DLL
          PID:3092
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RETURN FILES.txt
        1⤵
          PID:3048
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\WriteDisable.m1v.id-3F554453.[lockhelp@qq.com].jack
          1⤵
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3256
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WriteDisable.m1v.id-3F554453.[lockhelp@qq.com].jack
            2⤵
            • Opens file in notepad (likely ransom note)
            PID:2308

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Privilege Escalation

        Defense Evasion

        File Deletion

        2
        T1107

        Modify Registry

        2
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        Query Registry

        1
        T1012

        Peripheral Device Discovery

        1
        T1120

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Exfiltration

        Command and Control

        Impact

        Inhibit System Recovery

        2
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-3F554453.[lockhelp@qq.com].jack
          Filesize

          6.3MB

          MD5

          ca65fd42fbf0606edc82483ca7bcd16c

          SHA1

          bae6b94c9d24450c817ada3e53a27817a7d5db2c

          SHA256

          55e41bb407bdf1aa1b2c8a7c84b0b5a8942b38ed9ab0a80599de304059ff75ee

          SHA512

          2243bb7fc55966919a2efce6d39fcf349dae0f176c00927028d7bbfdadb627aeeb8bd99ef412ff11af74b3c14bad96879af3d4ea7d22641d59b76902c673a03a

          Download Submit
        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
          Filesize

          13KB

          MD5

          df6f84e7ae8a69b7d4389d887518d494

          SHA1

          8d546a2ced55eb6ea6ace36af9d1974ba5d265cb

          SHA256

          0cab664ef40fd5a998da3a5bacf0a4f4de752c293047c563882e1e14ca6b4c1e

          SHA512

          c063bd78de9638016cb134ce27422bbadec6b84cd64bc0e7e687ae9943ef708933502a876575ce725f2fb9be3923b1b3a5c82e19ffb38fa2066335c30d81af74

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
          Filesize

          13KB

          MD5

          df6f84e7ae8a69b7d4389d887518d494

          SHA1

          8d546a2ced55eb6ea6ace36af9d1974ba5d265cb

          SHA256

          0cab664ef40fd5a998da3a5bacf0a4f4de752c293047c563882e1e14ca6b4c1e

          SHA512

          c063bd78de9638016cb134ce27422bbadec6b84cd64bc0e7e687ae9943ef708933502a876575ce725f2fb9be3923b1b3a5c82e19ffb38fa2066335c30d81af74

          Download Submit
        • C:\Users\Admin\Desktop\RETURN FILES.txt
          Filesize

          142B

          MD5

          7e6028e7e55ae7b08987319a0689a2a3

          SHA1

          48a6e59cc6e2ea0d5dad6ca8621d2f0f8b501fd9

          SHA256

          d5d3da69d8dc722017261aed77e377e81efe51042046df723a0460cc8b73b2c0

          SHA512

          bcee11b2991e410d24a1511ef6ec0577c0101937d34291aecfa7221b66d294a250f76c60657aa3435676ba09e71343a22b3504bac733ef3242a2ec6b31f3f957

          Download Submit
        • C:\Users\Admin\Desktop\WriteDisable.m1v.id-3F554453.[lockhelp@qq.com].jack
          Filesize

          183KB

          MD5

          e974d39618d202cf5704ac5e5e149302

          SHA1

          bdefb7ed98fdd65af1f835420f12dd5822f17933

          SHA256

          1fdc211974632d3c309e728246b214314ad2dcd009376f57658d69c49f2baeda

          SHA512

          6ab2c76f9c457f6431efcfce8e77b403cf460a938b330f0399904d7c4d7f3cfca7e76a79553470b915ac74222420702579e7296597651f1b62ac5a8e984b0f5a

          Download Submit
        • C:\Windows\Installer\MSI37E3.tmp
          Filesize

          257KB

          MD5

          d1f5ce6b23351677e54a245f46a9f8d2

          SHA1

          0d5c6749401248284767f16df92b726e727718ca

          SHA256

          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

          SHA512

          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

          Download Submit
        • C:\Windows\Installer\MSI5D2F.tmp
          Filesize

          257KB

          MD5

          d1f5ce6b23351677e54a245f46a9f8d2

          SHA1

          0d5c6749401248284767f16df92b726e727718ca

          SHA256

          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

          SHA512

          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

          Download Submit
        • \PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\OFFICE.ODF
          Filesize

          4.1MB

          MD5

          c3da214ab5fb2e66e61fd8f63f72839f

          SHA1

          0ad2b19a1a59ec94d373d2c865431300c849902b

          SHA256

          9f4845358945756d231b58d2be9dddd1f436df1955daa79ab04149cf1289f4ef

          SHA512

          84f8035d685d517a0e5de019e61674288c087a48a5e01e1b9315e51ff9a4aa84fa72eb2487fd3357d5a1006a4e7c7ef343707347f997e1b66964b9e6c47c64f7

          Download Submit
        • \PROGRA~1\MICROS~2\Office14\1033\GrooveIntlResource.dll
          Filesize

          8.4MB

          MD5

          48019bd50a809545c202053313cd4b57

          SHA1

          60c431499a9f225334032a2f13b825f7a9da8680

          SHA256

          f9d97706a48caead3004a695b57c252103a67f0be66ba58807b1ed430bbb74fd

          SHA512

          f0ab826b0ee57de7909041671462b87f52fa2837501d1f4fa85d159aadab77f340b12cf5f97ab8a4c1b1d6428c35561e9118f6bb5b3c86628bd93b3d8b7198aa

          Download Submit
        • \PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
          Filesize

          6.4MB

          MD5

          a71a930e1e61e73da97423bdb95ce2d8

          SHA1

          8779f17ce0f68aef21969e39e1d84019bea04118

          SHA256

          80f65cbcf64bf5de2c957c83af1a41e9fd624bb88c873a4204ccde77ed428be7

          SHA512

          6f36d227d8328b411a8a7eb776eb49de7a4dcb8e18df5caccbf27114b56a79c327b1c9b13bb2d18ff6ca3738bb3a13d819c9b5693385d0a4fe385586f03beac5

          Download Submit
        • \Windows\Installer\MSI37E3.tmp
          Filesize

          257KB

          MD5

          d1f5ce6b23351677e54a245f46a9f8d2

          SHA1

          0d5c6749401248284767f16df92b726e727718ca

          SHA256

          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

          SHA512

          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

          Download Submit
        • \Windows\Installer\MSI5D2F.tmp
          Filesize

          257KB

          MD5

          d1f5ce6b23351677e54a245f46a9f8d2

          SHA1

          0d5c6749401248284767f16df92b726e727718ca

          SHA256

          57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

          SHA512

          960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

          Download Submit
        • memory/2592-20126-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp
          Filesize

          64KB

          Download