Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-06-12...ma.exe

windows7-x64

10

2024-06-12...ma.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 14:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe

  • Size

    92KB

  • MD5

    696a63ef620b7144d96d623ced6cb6f1

  • SHA1

    c1083d0befdafe3258b2a790d826b9be52c91b14

  • SHA256

    aefe553b2bca2136b54334085f5073123d2d9406d4b3719ca1a54a6bbfe3aecf

  • SHA512

    f7a69680b2bbaa80605f2f2e5628aaf7e54c79140fa61da258aa81af87578b8be2794729b6b0eac63922d771b8d89ab50597d1e49fee3997e5d2c2864a9d7979

  • SSDEEP

    1536:GBwl+KXpsqN5vlwWYyhZ9S4AiVMbXwOstfc/EqcKBxAvhzvcR:ww+asqN5aW/hSRwOstcMqckeK

Score
10/10
dharmadefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (669) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:4088
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:5528
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:8876
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:4376
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
            PID:8468
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:4212
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5660

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-F2E9490B.[[email protected]].bmd
            Filesize

            2.7MB

            MD5

            ce9f0a734eed7a15dd2164dd69553a74

            SHA1

            b7485c6e3b8efac2bd20f03242dfbac774481a4a

            SHA256

            b285a75a047867956d25adcecbc737341ea6007cd8bf900ee72b4903a1857c4d

            SHA512

            daba6c0fff5f272797169976358f0ff4f5d517753799dd5a1f411dd5b7a6b14faaa419577b07887bdcd210041f34d7d663c41aa1640537e07e57d12dd91fa0ca

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
            Filesize

            7KB

            MD5

            517b79944630a66be8afba719f6fff48

            SHA1

            57de7d52d95ca0a25cd42dc9bf1b26509875c32d

            SHA256

            2b3aae98b3e9cc5ab97f96848ae8f076541b1ae35922ab6f3766bc9f74b082df

            SHA512

            a4bf752f5f5164360690e3a23a0c26bae416b0ed6c640733faf29d789f66d65aeae23633b282d9de30a1c96e7d1ab84900021dff9bb87554569dfe5044afd718

            Download Submit