Analysis
-
max time kernel
0s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2023 19:55
Static task
static1
Behavioral task
behavioral1
Sample
0f2c4685932a74e8a7bd4733ceea0fcc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0f2c4685932a74e8a7bd4733ceea0fcc.exe
Resource
win10v2004-20231222-en
General
-
Target
0f2c4685932a74e8a7bd4733ceea0fcc.exe
-
Size
92KB
-
MD5
0f2c4685932a74e8a7bd4733ceea0fcc
-
SHA1
51201bbf3d9b532d8882a4cda4fa40f35d093179
-
SHA256
b0817a23a0189f43f8ceeb9899ade839f07da58dcf5a522d563c15382fba305a
-
SHA512
c397d75914c49eba7725f886845aa8a6b02cfbbaef59f858507b0ebce836aafb9743bafd2f409097ec45eb68e0c333cfda0fc0607b37ddbbaca6c23e2f73d461
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A+owcTqXrUMW/E4RwlROQA1d2x3u:Qw+asqN5aW/hL0X6wbmd2x3u
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
itteam122@aol.com
itteam122@techmail.info
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0f2c4685932a74e8a7bd4733ceea0fcc.exe 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0f2c4685932a74e8a7bd4733ceea0fcc.exe = "C:\\Windows\\System32\\0f2c4685932a74e8a7bd4733ceea0fcc.exe" 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\desktop.ini 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Drops file in System32 directory 1 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process File created C:\Windows\System32\0f2c4685932a74e8a7bd4733ceea0fcc.exe 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Drops file in Program Files directory 64 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\7-Zip\Lang\kab.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\ConnectFormat.m4v.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\7-Zip\Lang\ro.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\7-Zip\Lang\sw.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\7-Zip\Lang\tk.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-string-l1-1-0.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\7-Zip\Lang\es.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\7-Zip\Lang\cs.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\.version.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\7-Zip\7-zip.chm.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.rll 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.id-E0612F7C.[itteam122@aol.com].ROGER 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 5560 vssadmin.exe 6320 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.exepid process 4380 0f2c4685932a74e8a7bd4733ceea0fcc.exe 4380 0f2c4685932a74e8a7bd4733ceea0fcc.exe 4380 0f2c4685932a74e8a7bd4733ceea0fcc.exe 4380 0f2c4685932a74e8a7bd4733ceea0fcc.exe 4380 0f2c4685932a74e8a7bd4733ceea0fcc.exe 4380 0f2c4685932a74e8a7bd4733ceea0fcc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0f2c4685932a74e8a7bd4733ceea0fcc.execmd.exedescription pid process target process PID 4380 wrote to memory of 3472 4380 0f2c4685932a74e8a7bd4733ceea0fcc.exe cmd.exe PID 4380 wrote to memory of 3472 4380 0f2c4685932a74e8a7bd4733ceea0fcc.exe cmd.exe PID 3472 wrote to memory of 1020 3472 cmd.exe mode.com PID 3472 wrote to memory of 1020 3472 cmd.exe mode.com PID 3472 wrote to memory of 5560 3472 cmd.exe vssadmin.exe PID 3472 wrote to memory of 5560 3472 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f2c4685932a74e8a7bd4733ceea0fcc.exe"C:\Users\Admin\AppData\Local\Temp\0f2c4685932a74e8a7bd4733ceea0fcc.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\mode.commode con cp select=12511⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet1⤵
- Interacts with shadow copies
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-E0612F7C.[itteam122@aol.com].ROGERFilesize
9KB
MD59f298ed6d8263431d7b04baa678a3682
SHA1a4decca197d5d07edba022b57e953e7adf626642
SHA2562fed0fabf6ae409d105411e456b75271312aa9a5b1333dc260f0e1ab150cc6f8
SHA51223c2bdefaff7f958cc8682c15ee114a1f614fb71eab5c042d122345e06006c23a68ab8046e89bdeed4b897d21f2646354147e15c1a6ef4f0915ad5da30ff90f2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5fb982740276921d47692c8b5a1eeb221
SHA12bef63c27f6c6ccdf8cba0b4e207db7328f13440
SHA2569a86eced34a395fb0709dec13ed94c8c6e9fb2e0f1b8ea3bfd3397e338936229
SHA5126f9a76e6cb4aa5a57a71b43aa3a6d6693ccd8e02f9864ac87c2327fd92201fb4ffa4885e484eec83a16733b44f3ecc3ec31239950995f674ce979c7213f20cf5