General

  • Target

    30e1234ef3e570667526fdb006832b12

  • Size

    913KB

  • Sample

    231222-aezqqsdheq

  • MD5

    30e1234ef3e570667526fdb006832b12

  • SHA1

    01de8ba945945b58824f69553ac0f7b048645d45

  • SHA256

    72ea5a2972634a78b4808d2164517dc8dbed4eef24d05d135dbe537e05208bf2

  • SHA512

    00bd673f43cba1b16363433e672b30d22196fa0b67c024f970da15270323e545d15b3b990ed1dbbc3e7b9421c3f7840b10621c76203f89e0bcb1214e2a129e4e

  • SSDEEP

    24576:Utp7PNBIIr2i1VzBPZYpoEjH2NzQufi9Re+SfM+:uPSiJP+BH2NQufire+SfM+

Malware Config

Targets

    • Target

      30e1234ef3e570667526fdb006832b12

    • Size

      913KB

    • MD5

      30e1234ef3e570667526fdb006832b12

    • SHA1

      01de8ba945945b58824f69553ac0f7b048645d45

    • SHA256

      72ea5a2972634a78b4808d2164517dc8dbed4eef24d05d135dbe537e05208bf2

    • SHA512

      00bd673f43cba1b16363433e672b30d22196fa0b67c024f970da15270323e545d15b3b990ed1dbbc3e7b9421c3f7840b10621c76203f89e0bcb1214e2a129e4e

    • SSDEEP

      24576:Utp7PNBIIr2i1VzBPZYpoEjH2NzQufi9Re+SfM+:uPSiJP+BH2NQufire+SfM+

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (4102) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Disables Task Manager via registry modification

    • Disables taskbar notifications via registry modification

    • Disables use of System Restore points

    • Drops startup file

    • Modifies file permissions

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Indicator Removal

2
T1070

File Deletion

1
T1070.004

File and Directory Permissions Modification

1
T1222

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks