Overview

overview

10

Static

static

3

2024-01-11...ma.exe

windows7-x64

10

2024-01-11...ma.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12-01-2024 05:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-11_0197eb32a39518adbc118ec0559a395c_crysis_dharma.exe

  • Size

    92KB

  • MD5

    0197eb32a39518adbc118ec0559a395c

  • SHA1

    c81f411cb16e5692f7ea92eebb7f4120e4ad4129

  • SHA256

    5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22

  • SHA512

    97402aa309817bb12aa016b5d151158d3ea6bd5aee153ac726e66fda25f61e4dd6ae9a1274daba4eaab0a253bad3d38af2a04012cba0bdb9af0ef5ce209559d5

  • SSDEEP

    1536:mBwl+KXpsqN5vlwWYyhY9S4AR2DAQHPPyHn2OzT3R46F7pcwwTXO:Qw+asqN5aW/hL+v+Xl7l

Score
10/10
dharmapersistenceransomware

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All your files have been encrypted! Don't worry, you can return all your files! If you want to restore them, write to the mail: aerossh@cock.li YOUR ID aerossh@proton.me Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

aerossh@cock.li

aerossh@proton.me

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-11_0197eb32a39518adbc118ec0559a395c_crysis_dharma.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-11_0197eb32a39518adbc118ec0559a395c_crysis_dharma.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:2828
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2796
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
          PID:1880
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:2468
          • C:\Windows\system32\mode.com
            mode con cp select=1251
            3⤵
              PID:3296
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:1264
            • C:\Windows\System32\mshta.exe
              "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
              2⤵
                PID:1532
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2816

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Defense Evasion

            Indicator Removal

            2
            T1070

            File Deletion

            2
            T1070.004

            Modify Registry

            1
            T1112

            Credential Access

            Discovery

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Inhibit System Recovery

            2
            T1490

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id-68DA4445.[aerossh@nerdmail.co].AeR
              Filesize

              4.3MB

              MD5

              e7427e30a257b203f98709bd8ade0658

              SHA1

              a5f3d1e96a7ddf709b3b9752c99beefcd436b94b

              SHA256

              0ec5cd8c7d2aa80a44a942b2dda5f10a28254e08dc867d9577a11ef86f9cd125

              SHA512

              cb6796f4f9e98f67778719bc5428704bb10300f35ac79a3a58a42f00e9f7f617866418ccbcb8f9bc5145de9795e57755f4545b45ec484f71b5e4700b2029e190

              Download Submit
            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
              Filesize

              4KB

              MD5

              6866c872235e557d932fdee1e0184a02

              SHA1

              905ece293d7cab83e758b89ab3143fdf77532ae0

              SHA256

              5e72c55de7766b0566f7565537407a761cbd8e450edc3e70919c9b29469eb86e

              SHA512

              2c79ae4f71991518813ea6f2e61c39fc0da3359986c1482f29d79448e039b63d000205d4b028eb2dc48c23ef3a6732179a40a9959ac2fc416e05cbe58926383f

              Download Submit
            • memory/1532-20254-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp
              Filesize

              64KB

              Download