Analysis
-
max time kernel
1821s -
max time network
1819s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-03-2024 14:27
General
-
Target
ac7da11c38cce3b21137e629d76614f6350cbc96db41bede9029c83d9dfa98e2.exe
-
Size
211KB
-
MD5
ef8ab6db9a96b461f429f9f15b573164
-
SHA1
ac600bb15b21910c0fb6618825358ed6c60c037f
-
SHA256
ac7da11c38cce3b21137e629d76614f6350cbc96db41bede9029c83d9dfa98e2
-
SHA512
14a3b15ceef007915a558b48740f98a7a6335d42cfcc6498b2fb3ee40ff2e15496d4fdec0351f48cee36947e1ec981190721a877b8406a10456709d21be07a3e
-
SSDEEP
3072:b0WFcoAWykGuyF9ImZNI9UkwvYxzqea5KC7s7TJ:bfLXyL5F9XZNIsvYv
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
admin@sectex.net
admin@sectex.world
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (317) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7da11c38cce3b21137e629d76614f6350cbc96db41bede9029c83d9dfa98e2.exe"C:\Users\Admin\AppData\Local\Temp\ac7da11c38cce3b21137e629d76614f6350cbc96db41bede9029c83d9dfa98e2.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id-3C7AF601.[admin@sectex.net].botFilesize
4.1MB
MD5131590ba6f84a4fafe3f527ebc8b002d
SHA1277846eb35414ef8386063fb178f257f966aa56a
SHA2567836606b57e5aff30828db32f6be3facfc2c1630f32405186964dae82b35a1d7
SHA512648907bf2efef79c5fcfd878f13049740ba1d2cf2499aa990e5e84a7fb164b66d52e6490ba5f15f4e9fa216236c0e5addc186b50742ccd2f39a6691587e340fb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5226ad7dc26fa4c4766a9629de3661fe4
SHA11369dbd0e4b4cba8f8c93f078f7f939e51c64ef0
SHA256b7b28e65ab57735214f0afa338128a1777f5c39efe8dc367c717c5d4f870c91b
SHA51214c3a91d309215f2f3ea4f1057ca0a6de1356cd859b0f9de6fea3755827906ca8582bf6935c20a64779697ee28554e7ecee73a113bcd1f86ff8b4e88d3b06499
-
memory/1364-20096-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB
-
memory/2524-1-0x0000000004FE0000-0x00000000050E0000-memory.dmpFilesize
1024KB
-
memory/2524-2-0x0000000000220000-0x0000000000239000-memory.dmpFilesize
100KB
-
memory/2524-458-0x0000000000400000-0x0000000004E90000-memory.dmpFilesize
74.6MB
-
memory/2524-1880-0x0000000004FE0000-0x00000000050E0000-memory.dmpFilesize
1024KB
-
memory/2524-1881-0x0000000000220000-0x0000000000239000-memory.dmpFilesize
100KB