Overview

overview

10

Static

static

10

2024-06-12...ma.exe

windows7-x64

10

2024-06-12...ma.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 14:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-12_76cf59702e9eec0e14fae6da497d999e_crysis_dharma.exe

  • Size

    92KB

  • MD5

    76cf59702e9eec0e14fae6da497d999e

  • SHA1

    5f1b10bbb98e80d9d184a139271d4457407cc3bd

  • SHA256

    8f75e4e2ff12ce8cabe25e9aed3a965d247e2eebff5bccccb2d8efdb4eb6ca3e

  • SHA512

    89037308027f16f95adf9ad44049da01bb4e0138d5baee868ba27806582cf7f3831a184fc2f9f0e3ad84408ddba74786d2663c27c22f719950997ccda3b66540

  • SSDEEP

    1536:GBwl+KXpsqN5vlwWYyhZ9S4A0viICNPpzURZOZAKstB860gkyP2EO8rN:ww+asqN5aW/hSQ9CNPBURZzKsXx3PAEN

Score
10/10
dharmadefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (522) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_76cf59702e9eec0e14fae6da497d999e_crysis_dharma.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_76cf59702e9eec0e14fae6da497d999e_crysis_dharma.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:884
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:4440
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:6792
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5680
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:3600
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:9928
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
            PID:7232
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:3184
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2668

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-BAC6C1BB.[[email protected]].2020
            Filesize

            3.2MB

            MD5

            29e23761a055135dd1d552c73002b2ed

            SHA1

            60a4daa97a817a8d20ffd9706c014398b1cac50b

            SHA256

            27847d4aabf5bbad1177b6cc82e557ea99c855137367aa9095aac9cfd429b5ef

            SHA512

            e7607d843a12bbd2e267185aec7e20a39ddf96bef8b66cea1122767b858f7df6cfe126716c3f75976d8dc8a0481cc251a73f54afecac04daec91303294ccfac2

            Download Submit

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
            Filesize

            7KB

            MD5

            6a0f607686df9588094680cb13214bf9

            SHA1

            5c9a8553ca14828ac66c837d3be58b25874971e6

            SHA256

            67e4d67d5a7c3684c4490b210623f67de0a1ec933464333aa0f2ea4af1646118

            SHA512

            cc82461781a7d08c15b7a923bcb1f5daa0b4c4876dc4fb784ecabb7e1fbcc347ed413ba262fe27c4b1b968b4ac67ed2d2dd494b4c7839ef5a9c59639685cfa22

            Download Submit