General

  • Target

    2024-01-11_0197eb32a39518adbc118ec0559a395c_crysis_dharma

  • Size

    92KB

  • Sample

    240112-glzgwagef7

  • MD5

    0197eb32a39518adbc118ec0559a395c

  • SHA1

    c81f411cb16e5692f7ea92eebb7f4120e4ad4129

  • SHA256

    5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22

  • SHA512

    97402aa309817bb12aa016b5d151158d3ea6bd5aee153ac726e66fda25f61e4dd6ae9a1274daba4eaab0a253bad3d38af2a04012cba0bdb9af0ef5ce209559d5

  • SSDEEP

    1536:mBwl+KXpsqN5vlwWYyhY9S4AR2DAQHPPyHn2OzT3R46F7pcwwTXO:Qw+asqN5aW/hL+v+Xl7l

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All your files have been encrypted! Don't worry, you can return all your files! If you want to restore them, write to the mail: aerossh@cock.li YOUR ID aerossh@proton.me Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

aerossh@cock.li

aerossh@proton.me

Targets

    • Target

      2024-01-11_0197eb32a39518adbc118ec0559a395c_crysis_dharma

    • Size

      92KB

    • MD5

      0197eb32a39518adbc118ec0559a395c

    • SHA1

      c81f411cb16e5692f7ea92eebb7f4120e4ad4129

    • SHA256

      5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22

    • SHA512

      97402aa309817bb12aa016b5d151158d3ea6bd5aee153ac726e66fda25f61e4dd6ae9a1274daba4eaab0a253bad3d38af2a04012cba0bdb9af0ef5ce209559d5

    • SSDEEP

      1536:mBwl+KXpsqN5vlwWYyhY9S4AR2DAQHPPyHn2OzT3R46F7pcwwTXO:Qw+asqN5aW/hL+v+Xl7l

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Drops startup file

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

1
T1112

Impact

Inhibit System Recovery

2
T1490

Tasks