Analysis
-
max time kernel
166s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52b973c029f230ba1049d1438ff7a960exe_JC.exe
Resource
win7-20230831-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
52b973c029f230ba1049d1438ff7a960exe_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
52b973c029f230ba1049d1438ff7a960exe_JC.exe
-
Size
440KB
-
MD5
52b973c029f230ba1049d1438ff7a960
-
SHA1
c7c8790cd93463fea65921abfb44a5ed81788ab5
-
SHA256
a8987722e326199edfa57b05912e962115d7e408ece800b53ed84a78d6a195a6
-
SHA512
7b3b7aff02e7e15c557c618abfd243bb3b6510914aa8b2ea1eef76186c2ef7045a3848cded0b4530c67c113824c5b066fbca18df0f8a09e3e76795947d458605
-
SSDEEP
6144:LQkAFTZe+DD2/wNvGaNgmQPzSI58KP0Pt8piGijRTGJd9jB:kTFTZFDGwtGigBFeKP0Pt+iGEMTd
Score
10/10
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Renames multiple (163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\52b973c029f230ba1049d1438ff7a960exe_JC.exe 52b973c029f230ba1049d1438ff7a960exe_JC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\52b973c029f230ba1049d1438ff7a960exe_JC.exe = "C:\\Windows\\System32\\52b973c029f230ba1049d1438ff7a960exe_JC.exe" 52b973c029f230ba1049d1438ff7a960exe_JC.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1574508946-349927670-1185736483-1000\desktop.ini 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1574508946-349927670-1185736483-1000\desktop.ini 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\desktop.ini 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 52b973c029f230ba1049d1438ff7a960exe_JC.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\52b973c029f230ba1049d1438ff7a960exe_JC.exe 52b973c029f230ba1049d1438ff7a960exe_JC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaSansRegular.ttf 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\7-Zip\Lang\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Java\jre1.8.0_66\lib\content-types.properties.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msix.dll 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\7-Zip\Lang\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\7-Zip\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\7-Zip\Lang\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\7-Zip\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Java\jre1.8.0_66\bin\plugin2\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfr\[email protected] 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms 52b973c029f230ba1049d1438ff7a960exe_JC.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.id-9456CFCD.johnycryptor@hackermail.com.xtbl 52b973c029f230ba1049d1438ff7a960exe_JC.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4664 52b973c029f230ba1049d1438ff7a960exe_JC.exe 4664 52b973c029f230ba1049d1438ff7a960exe_JC.exe 4664 52b973c029f230ba1049d1438ff7a960exe_JC.exe 4664 52b973c029f230ba1049d1438ff7a960exe_JC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4664 wrote to memory of 3956 4664 52b973c029f230ba1049d1438ff7a960exe_JC.exe 85 PID 4664 wrote to memory of 3956 4664 52b973c029f230ba1049d1438ff7a960exe_JC.exe 85 PID 4664 wrote to memory of 3956 4664 52b973c029f230ba1049d1438ff7a960exe_JC.exe 85 PID 3956 wrote to memory of 420 3956 cmd.exe 87 PID 3956 wrote to memory of 420 3956 cmd.exe 87 PID 3956 wrote to memory of 420 3956 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\52b973c029f230ba1049d1438ff7a960exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\52b973c029f230ba1049d1438ff7a960exe_JC.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\mode.commode con cp select=12513⤵PID:420
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\[email protected]
Filesize2.3MB
MD50535c0b57d851cfe8ee142e9fb12c10f
SHA1aba98be84a96229a253d402cb829b92ad746b6f6
SHA256814a55cbdd23a75100fa8014906f415aeb8812abb4df166ede200c2bf3ece073
SHA512eee6cc98bb6f6bdffaabcb35ec47993779edc7786e85f80d1cb0ac45c91aac4c7019b1bb2f170f603812285728c577da49866e6e33794c2e0573029813306d8b