Overview

overview

10

Static

static

10

067f997e6f...40.exe

windows7-x64

10

0c0c9a19db...c1.exe

windows7-x64

10

1a8f35d0f2...b9.exe

windows7-x64

2354403f00...3b.exe

windows7-x64

240ac12f9c...0b.exe

windows7-x64

10

276727bfac...36.exe

windows7-x64

10

280a75ca5c...8e.exe

windows7-x64

2e8af1ad4b...51.exe

windows7-x64

10

32c51906c1...ec.exe

windows7-x64

3e84def5ee...96.exe

windows7-x64

403b8f1ce9...40.exe

windows7-x64

4731758b5f...25.exe

windows7-x64

9

4c21b335ba...49.exe

windows7-x64

10

4c99ac9f69...35.exe

windows7-x64

4fbbd67a32...a7.exe

windows7-x64

10

622e2834e5...95.exe

windows7-x64

10

6734e7474c...fd.exe

windows7-x64

67a00565a4...5d.exe

windows7-x64

6e228df5e4...62.exe

windows7-x64

7b93299c45...03.exe

windows7-x64

7c2a9bae3b...c1.exe

windows7-x64

10

7d9c97a133...b5.exe

windows7-x64

10

83b294975e...74.exe

windows7-x64

9b0cfabed9...8e.exe

windows7-x64

10

aa63528bf7...cd.exe

windows7-x64

b54d6dc708...7d.exe

windows7-x64

10

b6b2c1f4bb...00.exe

windows7-x64

10

ba43b2eb48...fb.exe

windows7-x64

cc43fc18d6...e8.exe

windows7-x64

10

d50b23e12c...af.exe

windows7-x64

10

ebb17d81ff...0f.exe

windows7-x64

ec09cfa4a7...da.exe

windows7-x64

10

Resubmissions

16-03-2024 17:17

240316-vtswysfd2y 10

16-03-2024 15:31

240316-syg9xafg39 10

15-03-2024 08:15

240315-j5rmgsbg5z 10

Analysis

  • max time kernel
    1800s
  • max time network
    1567s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-03-2024 15:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4c21b335baf9907cfaec588f25354b804b3d59f3882d923fbaf0d929b933ef49.exe

  • Size

    92KB

  • MD5

    ee524170a7ffc7ad48afc3a1e7377943

  • SHA1

    c9c8725012fbf7e9651b2e1519eaf17e86a65658

  • SHA256

    4c21b335baf9907cfaec588f25354b804b3d59f3882d923fbaf0d929b933ef49

  • SHA512

    d0efb486382698190e2d95090d04d70282a07315fae162b339d2d935ffabf5c1b22576aaa2ca2fbd5469d21354d097e05d6da5368706aa5e318c90f5a9825d43

  • SSDEEP

    1536:mBwl+KXpsqN5vlwWYyhY9S4AYotGG5Gq5XgH7id4NkzpvjNU4lm:Qw+asqN5aW/hL/GKp5wbk4Nkzphvo

Score
10/10
dharmapersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email Rileyb0707@aol.com YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: Rileyb0707@cock.li Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

Rileyb0707@aol.com

Rileyb0707@cock.li

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (328) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c21b335baf9907cfaec588f25354b804b3d59f3882d923fbaf0d929b933ef49.exe
    "C:\Users\Admin\AppData\Local\Temp\4c21b335baf9907cfaec588f25354b804b3d59f3882d923fbaf0d929b933ef49.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2660
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:2724
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2872
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:2748
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:3076
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:2408
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:840
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1128

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Indicator Removal

      2
      T1070

      File Deletion

      2
      T1070.004

      Modify Registry

      2
      T1112

      Credential Access

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      2
      T1490

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id-42A43F9F.[Rileyb0707@aol.com].nlb
        Filesize

        512KB

        MD5

        b6eec697020c91cd2403c97fe3cd7d8a

        SHA1

        d59bc6428a449ac5519030ade527ecd408802e3c

        SHA256

        5cf96e64a746ea1c99ca74696c66a2638527d51c9530441325f877ad2bda011f

        SHA512

        fbaad9da3f6c20bc970b65aad634bcda46bd292558c14f8a696c2f3df22cd8263f623ab530b2c31b37d39d37af5cf451ccdfcc3d31d729c531530aa2ed7c3a15

        Download Submit
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
        Filesize

        7KB

        MD5

        e64346cd981d102912d64daab5663463

        SHA1

        4a9b79b25d87f51d2918f5c18ca5345d6a02857b

        SHA256

        3cbc6129289120fd86b650183d7ffe2e76af04ca119196820f9cb50298d7c226

        SHA512

        9823bf4abe4606238d74c637826b549a31b3b861da2169dedb71d7f6b2d355ac6d1665436f484e99599e420dc245de071a830a94534ca6bb942805ac68d02ac3

        Download Submit