Overview

overview

10

Static

static

10

067f997e6f...40.exe

windows7-x64

10

0c0c9a19db...c1.exe

windows7-x64

10

1a8f35d0f2...b9.exe

windows7-x64

2354403f00...3b.exe

windows7-x64

240ac12f9c...0b.exe

windows7-x64

10

276727bfac...36.exe

windows7-x64

10

280a75ca5c...8e.exe

windows7-x64

2e8af1ad4b...51.exe

windows7-x64

10

32c51906c1...ec.exe

windows7-x64

3e84def5ee...96.exe

windows7-x64

403b8f1ce9...40.exe

windows7-x64

4731758b5f...25.exe

windows7-x64

9

4c21b335ba...49.exe

windows7-x64

10

4c99ac9f69...35.exe

windows7-x64

4fbbd67a32...a7.exe

windows7-x64

10

622e2834e5...95.exe

windows7-x64

10

6734e7474c...fd.exe

windows7-x64

67a00565a4...5d.exe

windows7-x64

6e228df5e4...62.exe

windows7-x64

7b93299c45...03.exe

windows7-x64

7c2a9bae3b...c1.exe

windows7-x64

10

7d9c97a133...b5.exe

windows7-x64

10

83b294975e...74.exe

windows7-x64

9b0cfabed9...8e.exe

windows7-x64

10

aa63528bf7...cd.exe

windows7-x64

b54d6dc708...7d.exe

windows7-x64

10

b6b2c1f4bb...00.exe

windows7-x64

10

ba43b2eb48...fb.exe

windows7-x64

cc43fc18d6...e8.exe

windows7-x64

10

d50b23e12c...af.exe

windows7-x64

10

ebb17d81ff...0f.exe

windows7-x64

ec09cfa4a7...da.exe

windows7-x64

10

Resubmissions

16-03-2024 17:17

240316-vtswysfd2y 10

16-03-2024 15:31

240316-syg9xafg39 10

15-03-2024 08:15

240315-j5rmgsbg5z 10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-03-2024 08:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    276727bfacdeba0ba864fd6ccecab5fd0f244576dc503d7cf148a4deb90fc136.exe

  • Size

    92KB

  • MD5

    58402f0f41e3bfecbea9ca1bcc0f0c2b

  • SHA1

    0a2b11df94790e1121c17e350eb846a236e0fbcf

  • SHA256

    276727bfacdeba0ba864fd6ccecab5fd0f244576dc503d7cf148a4deb90fc136

  • SHA512

    8155d0a3364ea067260ba9ad432e126b1da33a2c4c1c5f585112851c5765363cd6cc426263ef430b559e9b35eea938e19bf7cc2e50e6a6c356bba030664f9123

  • SSDEEP

    1536:mBwl+KXpsqN5vlwWYyhY9S4ALTroZbj0zTzn5W9qN9PI1fFznJGf0yG:Qw+asqN5aW/hLlTroZUzTz5W9qrI1JIH

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email fastrecovery@onionmail.org YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: fastrecovery2@msgsafe.io Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

fastrecovery@onionmail.org

fastrecovery2@msgsafe.io

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (317) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\276727bfacdeba0ba864fd6ccecab5fd0f244576dc503d7cf148a4deb90fc136.exe
    "C:\Users\Admin\AppData\Local\Temp\276727bfacdeba0ba864fd6ccecab5fd0f244576dc503d7cf148a4deb90fc136.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:2992
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2772
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:4092
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:2744
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:3600
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:3896
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2560

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Indicator Removal

      2
      T1070

      File Deletion

      2
      T1070.004

      Modify Registry

      2
      T1112

      Credential Access

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      2
      T1490

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id-F275D0FF.[fastrecovery@onionmail.org].ROGER
        Filesize

        7.4MB

        MD5

        2126d08b10f90b1e12d3e94e7951de0b

        SHA1

        a6971159fde13bd9f7d95dce7a929074c405caeb

        SHA256

        b01fdc0dabffa2dec445cc41b54baa42eed506b645d1251cc0e5aa1ccb52f6c1

        SHA512

        e561e02807ffdc00ec432c399ce57b956ca3f239ceb89cca972b8cf2c3f1121eea433ca6ccef9573afd5b925173515accdc451285cdb9ff52af05131583904be

        Download Submit
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
        Filesize

        7KB

        MD5

        13e8856c1041a078759dace7087d5bfe

        SHA1

        2c94d386ee082a06cbda0f9da3dbf7c5ffb90ecb

        SHA256

        3af68ab7759cae0cdc300e0dbb3bb63fe5a89632e370309de3e19db62b43b833

        SHA512

        892923b246fce175de9f0817cc2d422b9050b6dae7a7552433f093106983357b70185fc4b0dbbb86f1b28e2d113200f7d4f08fc1aebb4acfd01cf744edd35c16

        Download Submit