Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-03-2024 14:27
General
-
Target
75a9ade19696be512a894b659c4bebd174a868f404da5479f4fd96494e04c71d.exe
-
Size
306KB
-
MD5
1eac69691e05297182ea6642746d53f6
-
SHA1
749f19b262849158df6d29f26043e1a845da102e
-
SHA256
75a9ade19696be512a894b659c4bebd174a868f404da5479f4fd96494e04c71d
-
SHA512
8ac6625fa10b3d2126a6498af2790a52bb626fef74b4abf05ce869f0e3b2d41fa78915b469529c67531937093e6385634985e792f4c04edac5f0b69a489d5c39
-
SSDEEP
3072:J86Kas04uVswV5Him+xfleiJfz/4B7zspXGwtI57T+YG4tGSGbwySvB5KpzeLrqK:ChatLSeoQ7Rwu57C0bNyKgpGR
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@fentex.net
admin@fentex.world
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\75a9ade19696be512a894b659c4bebd174a868f404da5479f4fd96494e04c71d.exe"C:\Users\Admin\AppData\Local\Temp\75a9ade19696be512a894b659c4bebd174a868f404da5479f4fd96494e04c71d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.id-D658F9CF.[admin@fentex.net].moneyFilesize
1.3MB
MD5c512d870c710891e07c903de187ffa21
SHA1e051e20da53b458ac1124e27d231da494f674b38
SHA256a965f50c467a01f3ae5e96cb16ce5f39b2e95cf01a3c6fefa4a3a76f249eb1ee
SHA512f2513ee48234b49cf75b35eb512f824e39d0bab5fe94e9a410610ca5f4d6e72ccfa52b91ca5c14d30ac9fc8af680290eccc4dca15c4421a802019f6c4a4913f5
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5729a7b0eb6172c2d9bcb00a5796206c7
SHA1e695d241f09f19e07f6576f1c12391b9f6c17b08
SHA256da8ac019556fbb8de98a3a1f966f35e4918ba31be1c3a7db90b435fe6091fb24
SHA512ac2e0a99f95b0ef5d2fa462fbc89254625360e762ee0137d9af872502ccdce84d2c3c7a994e2eb661d3ad6c5bf5b36c6286f7990008ac7f81c50c282b6f6bf6e
-
memory/1304-20215-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmpFilesize
64KB
-
memory/1620-20190-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB
-
memory/3044-1-0x0000000003770000-0x0000000003870000-memory.dmpFilesize
1024KB
-
memory/3044-2-0x0000000000020000-0x0000000000039000-memory.dmpFilesize
100KB
-
memory/3044-168-0x0000000000400000-0x00000000035A1000-memory.dmpFilesize
49.6MB
-
memory/3044-13923-0x0000000003770000-0x0000000003870000-memory.dmpFilesize
1024KB