General

  • Target

    2024-06-11_c6e7557c9410d9e567f9c39843f7e393_crysis_dharma

  • Size

    92KB

  • Sample

    240611-a2xjwsxcjd

  • MD5

    c6e7557c9410d9e567f9c39843f7e393

  • SHA1

    c26d408c07db466b4c8883b8eb3446c98f19f8c1

  • SHA256

    b7fdcfadbe335a256dbe88321044768bf4d8c1da7afc67ff7ace127310289dde

  • SHA512

    8d29d84227b800e45649c7d344e4b5f5b80a3d2f0a59e963c4e26dc85f9b0518e2e78383a87d0a8bbc1c0c78e6ab9de5ea8002936a38d6e33e7b82a3da737b51

  • SSDEEP

    1536:GBwl+KXpsqN5vlwWYyhZ9S4ACURxvunaBCgUvZ2Yqwt10U:ww+asqN5aW/hSsYxvjTGYyH

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Targets

    • Target

      2024-06-11_c6e7557c9410d9e567f9c39843f7e393_crysis_dharma

    • Size

      92KB

    • MD5

      c6e7557c9410d9e567f9c39843f7e393

    • SHA1

      c26d408c07db466b4c8883b8eb3446c98f19f8c1

    • SHA256

      b7fdcfadbe335a256dbe88321044768bf4d8c1da7afc67ff7ace127310289dde

    • SHA512

      8d29d84227b800e45649c7d344e4b5f5b80a3d2f0a59e963c4e26dc85f9b0518e2e78383a87d0a8bbc1c0c78e6ab9de5ea8002936a38d6e33e7b82a3da737b51

    • SSDEEP

      1536:GBwl+KXpsqN5vlwWYyhZ9S4ACURxvunaBCgUvZ2Yqwt10U:ww+asqN5aW/hSsYxvjTGYyH

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (325) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks